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FULL COMITTEE HEARING ON 
SARBANES-OXLEY SECTION 404: 
WILL THE SEC’S AND PCAOB’S 
NEW STANDARDS LOWER 
COMPLIANCE COSTS FOR SMALL 
COMPANIES? 


TUESDAY, JUNE 5, 2007 

U.S. House of Representatives, 

Committee on Small Business, 

Washington, DC. 

The Committee met, pursuant to call, at 2:10 p.m., in Room 2360 
Rayburn House Office Building,Hon. Nydia M. Velazquez [Chair- 
woman of the Committee] presiding. 

Present: Representatives Velazquez, Larsen, Clarke, Ellsworth, 
and Chabot. 

OPENING STATEMENT OF CHAIRWOMAN VELAZQUEZ 

ChairwomanVELAZQUEZ. I call this hearing to order. 

This afternoon the Committee will examine implementation of 
Section 404 of the Sarbanes-Oxley Act and consider whether the 
new standards that the SEC and PCAOB approved last month will 
lower compliance costs for smaller companies. 

Small firms continue to be supportive of the intent of the Sar- 
banes-Oxley Act and many have benefited from the stronger cor- 
porate government’s culture that it encourages. What we continue 
to find is that many aspects of complying with SOX, and particu- 
larly those associated with Section 404, are disproportionately im- 
pacting small companies. These continue to make me believe that 
these new regulations should be delayed. 

This additional time is especially important for smaller compa- 
nies which often operate with limited human and financial re- 
sources and may be unreasonably burdened by these high costs. We 
may jeopardize some of our country’s most innovative endeavors if 
we fail to adequately balance investor protection with the associ- 
ated regulatory burden. 

Last month new management guidance and an auditing standard 
for Section 404 were approved. The result of nearly 2 years of 
work, this new standard seeks to make Sarbanes-Oxley compliance 
more efficient and cost effective for companies of all sizes. While I 
am encouraged by this, I am concerned about the proposed timeline 
under which small firms will have to comply with the new regula- 
tions. 


( 1 ) 
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An important step to mitigating this will be, prior to the SEC’s 
approval of the auditing standard, the Commission should under- 
take a full analysis as prescribed by Section 603 of the Regulatory 
Flexibility Act. This will ensure that this regulation is appro- 
priately tailored. 

Earlier this year Ranking Member Chabot and I wrote to Chair- 
men Cox and Olson and expressed our concern that the proposed 
implementation timeline was inadequate to assess its effectiveness. 
Postponing the December 2007 and December 2008 deadlines by at 
least 1 year would allow for the new standards to be tested and for 
evidence to be collected that could confirm that the new standards 
do, in fact, lower costs for small firms. 

Small businesses are significant sources of research and develop- 
ment, job creation and innovation in our economy. It is critical that 
the SEC and PCAOB work to ensure that SOX 404 is implemented 
in a way that contributes to increased investor confidence, but that 
also does not hamper America’s competitiveness. Postponing the 
compliance deadlines for at least an additional year would allow us 
to make this determination. 

A delay will also provide training for small companies and audit- 
ing firms. It will also permit the PCAOB’s efficiency inspectors to 
assess whether audit firms are implementing the new standards in 
the manner intended. At a minimum these steps will help ensure 
a more effective implementation of these new standards and recog- 
nize the unique situation that many companies find themselves in. 

These new standards come at a time when small businesses are 
already spending 45 percent more than larger firms on regulatory 
compliance. To ensure that these burdens become more manage- 
able we should not be piling new regulations on until they have 
been thoroughly reviewed. Today’s hearing will help us accomplish 
this, and by doing so, it will demonstrate that a delay is necessary 
to better balance the cost and benefits of these new standards. 

I would like to take this opportunity to welcome Chairman Cox 
and Chairman Olson and also to thank the members from the sec- 
ond panel that are traveling from across the country to be here to 
shed some insight regarding the implementation of Section 404 on 
small firms. 

Now I recognize Mr. Chabot for his opening statement. 

OPENING STATEMENT OF MR. CHABOT 

Mr. Chabot. Thank you. Madam Chairwoman, and thank you for 
holding this hearing on Section 404 of the Sarbanes-Oxley Act and 
its impact on small businesses. 

The Sarbanes-Oxley Act has been described as the most impor- 
tant and far-reaching securities legislation since the Securities Act 
of 1933 and the Securities Exchange Act of 1934, which were 
passed following the stock market crash back in 1929. Signed into 
law in 2002 in response to the bankruptcy of Enron Corporation, 
the WorldCom scandal and other corporate failures, the Sarbanes- 
Oxley Act established the Public Company Accounting Oversight 
Board, a private-sector, nonprofit organization that oversees public 
company auditors and enacts auditing standards. The act also re- 
stricts accounting firms from performing a number of other services 
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for companies which they audit and requires new disclosures for 
public companies and officers and directors. 

While the act has generally been viewed as necessary to restore 
public and investor confidence in our capital markets and improve 
the reliability and transparency of commercial financial reports, 
concerns have been raised about the burden and cost of compliance 
for small- and medium-sized companies. 

One of the most controversial provisions, Section 404, manage- 
ment assessment of internal controls, requires management and 
auditors to assess internal controls over financial reporting and re- 
quires external auditors to report on management’s assessment 
and certify to the effectiveness of internal controls. 

The Securities and Exchange Commission greatly underesti- 
mated the amount that it would cost small businesses to comply 
with Section 404. According to an April 2006 Government Account- 
ability Office study, small businesses expend a disproportionately 
greater amount of time and money as a percentage of revenues 
compliant with Sarbanes-Oxley than large public companies. Firms 
with $1 billion or more spend 13 cents per $100 in revenue for 
audit fees to comply with Sarbanes-Oxley regulations, while small 
businesses spend more than $1 per $100. 

It is generally agreed that Sarbanes-Oxley has had a positive ef- 
fect on investor protection and confidence, but its burden on small 
business has not only affected their bottom line, but also their com- 
petitiveness in our global academy. 

GAO found that small businesses used resources for Sarbanes- 
Oxley compliance rather than for other business activities. Re- 
cently, the Kauffman-RAND Center for the Study of Small Busi- 
ness and Regulation said that Sarbanes-Oxley caused small firms 
to exit the public capital market. Last year the Securities and Ex- 
change Commission announced that it would delay the application 
of Section 404 to the smallest companies until later in 2007. 

Earlier this year the chairwoman and I together urged the SEC 
to delay implementation of the new internal control standards to 
allow small businesses additional time to comply. On May 23, 2007, 
this year, the SEC announced it would not allow such an extension. 
At its May 23, 2007, meeting the SEC adopted rules designed to 
reduce costs for compliance with Section 404 for all businesses. In 
addition, the Commission adopted proposed rules examining the 
general disclosure requirements for small companies wanting to go 
public. This represents an excellent opportunity for the Commis- 
sion to examine the cumulative impact of its rules on small compa- 
nies and reduce those while still striving to maintain investor con- 
fidence. 

Madam Chairwoman, I commend you for holding this hearing on 
Section 404 compliance. I want to note that in addition to our panel 
of experts we have with us an attorney from Cincinnati, my dis- 
trict, who has real-world experience in helping small public com- 
pany clients to deal with the challenges of Section 404 compliance. 

I look forward to this hearing from each of our witnesses. We 
want to thank them in advance for their testimony. 

And I also want to welcome to Washington, D.C., my brother, my 
younger brother, 10 years younger, Dave, and his wife Ellen who 
are with us today with their four beautiful children and they are 
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in the back there. How about the whole family stand up back there. 
Kids, come on and stand up. We don’t have visitors up here all that 
often. There are a whole bunch of them there. So those are Chabots 
back there. And that’s how we pronounce it, even though it gets 
pronounced all different ways up here. 

ChairwomanVELAZQUEZ. And welcome to my club. 

Mr.CHABOT. Exactly. That’s right. I yield back my time. 

ChairwomanVELAZQUEZ. Thank you. 

Our first witness is our former colleague, the Honorable Chris- 
topher Cox. He is the 28th chairman of the Securities and Ex- 
change Commission. He was appointed by President Bush on June 
2, 2005, and unanimously confirmed by the Senate on July 29, 
2005. During his tenure at the SEC Chairman Cox has brought 
groundbreaking cases against a variety of market abuses, including 
hedge fund insider trading, stock options back-dating and securi- 
ties scams on the Internet. 

Prior to joining the Securities and Exchange Commission, Chair- 
man Cox served for 17 years in Congress where he held a number 
of positions of leadership in the U.S. House of Representatives. 

Honorable Christopher Cox, you are welcome and we are very 
grateful that you are here with us today. 

STATEMENT OF THE HONORABLE CHRISTOPHER COX, 
CHAIRMAN, SECURITIES AND EXCHANGE COMMISSION 

Mr. Cox. Madam Chairwoman, thank you very much for your 
gracious introduction to my colleagues. I am very, very honored 
with the opportunity to be here, along with Chairman Olson, to 
talk about this very important subject. 

The Committee has a very important charge, and we share a 
good portion of what you are responsible for within our sphere at 
the Securities and Exchange Commission. We all have a responsi- 
bility to the millions of small businesses in America and, in that 
way, to our economy. 

For our part, the SEC is charged by statute with the protection 
of investors, fostering efficient markets and the promotion of cap- 
ital formation. Small business needs all of these in order to survive. 
So like every member of this Committee, the SEC is completely 
committed to fostering a climate of entrepreneurship. That climate 
is necessary to help promote small business growth, and it is nec- 
essary to the creation of the many jobs and goods and services in 
our country that are produced by small business. 

Today, as every member of this Committee well knows, there are 
over 6,000 public companies that are smaller businesses that still 
aren’t required to comply with Section 404 of the Sarbanes-Oxley 
Act of 2002. Generally that is every public company with securities 
registered with the Commission if it has less than $75 million in 
public equity. 

The Commission has, as you have noted, delayed Section 404 
compliance for smaller companies precisely because of the dis- 
proportionately high costs that they face compared to larger compa- 
nies. Our experience in the first 3 years of compliance after the en- 
actment of SOX told us that the way that 404 was being imple- 
mented was too expensive for everyone. And imposing that system 
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on the smallest companies would impose unacceptably high costs 
from the standpoint of the companies’ investors who would have to 
pay the bills. 

So the Commission and the Public Company Accounting Over- 
sight Board set out to address the unique concerns of small busi- 
ness; and as you are aware, the Commission has carefully phased 
in application to the 404 requirements. We have repeatedly de- 
ferred 404 compliance for smaller companies with the very positive 
result of this determination to phase in 404 for smaller companies 
being that we and they have had and will have the opportunity to 
field test the requirements first. 

Now we are using what we have learned thus far and we will 
continue to use what we learn to lessen the burden for smaller 
companies that eventually will have to comply with Section 404. 
We have little doubt that the SEC’s new guidance, specifically for 
management, and the PCAOB’s new standard, which Chairman 
Olson will talk about in a little more detail in a moment, will be 
of significant help to smaller companies when, beginning with their 
SEC annual filings in 2009, they eventually comply with the audit 
provisions of Section 404. In the meantime, for their filings in 
2008, they will have to comply only with the management assess- 
ment portion of Section 404. 

For this purpose, the SEC’s new guidance should be especially 
helpful. It is written in plain English. It suggests that certifying of- 
ficers at smaller companies ask themselves two basic questions: 
First, do my employees understand what they need to do to prepare 
reliable financial statements; and second, what information do I 
need to be sure that they have done those things. 

The answers to these questions needn’t be complicated or costly. 
And certainly our guidance won’t make them so. In fact, the guid- 
ance clearly highlights the areas where cost-effective implementa- 
tion has been a challenge for small companies in the past so that 
these pitfalls can be avoided, and it explains how a small company 
might approach 404 differently than a large company. None of this 
should be unduly difficult for most companies, and it certainly does 
not require the 404 audit that has had smaller companies so con- 
cerned about cost. 

As we meet here in mid-2007, the requirement of an internal 
control audit under Section 404 won’t apply to smaller public com- 
panies with calendar and fiscal years until their filings in the 
spring of 2009, almost 2 years from now. In the meantime, those 
smaller companies can begin to get ready for full SOX 404 compli- 
ance by undertaking their own assessments of internal controls be- 
ginning with their SEC reports in 2008. 

So, in response to suggestions that the Commission should ex- 
tend 404 compliance for another year, the answer is that smaller 
companies won’t be required to come into full compliance with SOX 
404 until their report is due in March 2009, almost 2 years from 
now. This schedule gives smaller companies the benefit of doing an 
initial internal assessment of their controls without the added bur- 
den and cost arising from an external audit. We fully expect that 
by the end of 2008 management’s familiarity with the 404 process 
and its documentation of internal controls will make it easier and 
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less expensive to do an external audit than it would have been 
under the previous system. 

Madam Chairwoman, the focus of this hearing is on whether the 
SEC’s new guidance for management and the PCAOB’s new stand- 
ard for auditors will lower compliance costs for small companies. 
The answer to that question is "yes." we expect the unduly high 
costs of implementing Section 404 of the act under the previous au- 
diting standard will come down. They should come down because 
now a company will be able to focus on the areas that present the 
greatest risk of material misstatements in the financials. That is 
what the law has always intended we be focused on. It is always 
what investors care about; it is what is important for achieving re- 
liable financial reporting. 

Compliance costs should come down because the new SEC guid- 
ance that has been developed specifically for management will 
allow each small business to exercise significant judgment in de- 
signing an evaluation that is tailored to its individual cir- 
cumstances. Unlike external auditors, management in a smaller 
company tend to work with its internal controls on a daily basis. 
They have a great deal of knowledge about how their firm operates. 
Our new guidance allows management to make use of that knowl- 
edge, which should lead to a much more efficient assessment proc- 
ess. 

Compliance costs should also come down for the minority of 
smaller public companies that had already complied with Section 
404 under the old auditing standard. In recognition of the fact that 
many of those companies have already invested considerable re- 
sources in the design and the implementation of their processes the 
Commission’s guidance does not disrupt or require any changes to 
what they are now doing. 

While these smaller companies should benefit from the top-down, 
risk-based, materially focused and scalable nature of both the 
SEC’s new guidance and the PCAOB’s new auditing standard, they 
should not have to expend new resources to do so. 

The goal of our collective efforts in this area, the SEC and the 
PCAOB, is to implement Section 404 just as Congress intended in 
the most efficient and effective way to meet our objectives of inves- 
tor protection, well functioning financial markets and healthy cap- 
ital formation by companies of all sizes. We won’t forget the fail- 
ures that led to the passage of the Sarbanes-Oxley Act in the first 
place, and we won’t forget that for small business to continue to 
prosper, both strong investor protection and healthy capital forma- 
tion must go hand in hand. 

These past few weeks have witnessed several positive steps for 
small business at the SEC. Not only are we approaching the finish 
line in our work to rationalize and improve the 404 process for 
smaller companies, but also we are tackling several other issues of 
importance to our Nation’s small businesses. The most important 
of these is our effort to modernize and improve capital raising for 
small business and to simplify SEC reporting for small business. 
Many of these proposals would implement key recommendations 
made by the Commission’s Advisory Committee on Smaller Public 
Companies. 
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Our concerns for small business go hand in hand with our re- 
sponsibility to protect investors. It is, after all, investors who are 
injured and whose money is lost when the small businesses in 
which they invest can’t get affordable access to new capital. 

Madam Chairwoman, the SEC takes extremely seriously and 
equally seriously each element of its tripartite mission. The 404 re- 
forms, the capital-raising improvements that I just mentioned and 
the reporting simplifications that we proposed to benefit small 
business will, I am certain, help our country to accomplish all three 
of these objectives. 

Thank you again for the opportunity to speak on behalf of the 
Commission, and of course I will be happy to answer your ques- 
tions. 

ChairwomanVELAZQUEZ. Thank you Chairman Cox. 

[The prepared statement of Mr. Cox may be found on page 49 of 
the Appendix.] 

ChairwomanVELAZQUEZ. Our next witness is the Honorable 
Mark Olson, who became chairman of the Public Company Ac- 
counting Oversight Board on July 3, 2006. The PCAOB is a pri- 
vate-sector, nonprofit corporation created by the Sarbanes-Oxley 
Act of 2002 to oversee the auditors of public companies. 

Prior to his appointment to the PCAOB board, Mr. Olson served 
as a member of the Federal Reserve Board of Governors and the 
Federal Open Market Committee. Before becoming a member of the 
Federal Reserve Board, Mr. Olson held a number of positions in 
the banking industry and was a partner with the accounting firm, 
Ernst & Young. 

Welcome, sir. 

STATEMENT OF MARK W OLSON, CHAIRMAN, PUBLIC 
COMPANY ACCOUNTING OVERSIGHT BOARD 

Mr. Olson. Thank you very much. Madam Chairwoman 
Velazquez and Ranking Member Chabot and members of the Com- 
mittee, I am delighted to be here today on behalf of the PCAOB. 
I am pleased to be here with Chairman Cox, whom we have worked 
closely with in this effort. The full text of my statement has been 
submitted for the record, but I would like to make a couple of sum- 
mary comments and then be happy to answer any additional ques- 
tions that you might have. 

I think at the outset it is important to remember — and I know 
that all the members of the Committee do, but just as a reminder — 
the 404 does not apply to all small businesses. Section 404 applies 
to small businesses that choose to access the U.S. capital markets; 
and that is a critical distinction, because in exchange for your will- 
ingness to access the U.S. capital markets, the management has 
been asked to accept a heightened level of responsibility for the in- 
ternal controls over financial reporting. 

That new responsibility, I think, helps provide stability to the 
U.S. capital markets, but very importantly, it helps build con- 
fidence in markets for the average investor. And that is critically 
important because, as all of the members know, I am sure, over 
half of U.S. households are now equity holders in one form or an- 
other. In my mind, it is the essence of Sarbanes-Oxley 404. 
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And I agree with Ranking Member Chabot when he says that is 
probably the most significant legislation since the 1933 and the 
1934 Acts. But what it does is provide a level of confidence that 
wasn’t there before. But it is the third time Congress has chosen 
to act and to act in a way that has mandated internal controls over 
financial reporting. The first was the Foreign Corrupt Practices Act 
and the second was in FDICIA. 

That said, we are working in a number of ways to specifically 
focus on small business at the PCAOB in two particular ways that 
I would like to highlight: first of all, the fact that most of the reg- 
istrants that registered with us, the accounting firms, the auditing 
firms that registered with us, are themselves small businesses. 

I was surprised, when I looked closely at the statistics regarding 
the PCAOB, that there are 1,700 accounting firms, auditing firms, 
that have registered with the PCAOB, which means that there are 
1,700 firms that either now do or wish to audit companies that are 
traded in the U.S. public markets. Of those 1,700, 1,000 them are 
in the U.S., and of those 1,000, only 150 have 5 or more publicly 
traded companies that they audit. So 800-some — 850 roughly — 
firms that register with us either audit fewer than 5 or are not list- 
ed currently as the auditor of any, but they choose to. And that 
number is growing so that there is an increasing number of small 
firms around the country. There are 129, for example, in New York 
alone and 1934 in Ohio alone that fit this category. 

Also we have been working very hard to make sure that as we 
get closer to the implementation for the small, nonaccelerated filers 
that the small firms can be ready; and let me give you a couple of 
examples of what we are doing. 

First of all, we are hosting seminars around the country for the 
small accounting firms and, in some cases, members of audit com- 
mittees. We have done those with 21 different firms in 14 different 
markets, that have been attended by over 2,000 people, where we 
have acquainted them with the PCAOB; but more importantly, 
helped them understand and recognize the extent to which the re- 
sponsibility will be for auditing under Section 404, particularly for 
the nonaccelerated filers. 

Point number two is that we are working with a group of 12 ac- 
counting firms now to specifically focus on developing guidance for 
the smaller firms, so that as they are getting ready to audit on 404, 
we can help them identify how they would identify the key controls 
and how they would identify a control environment that would be 
more applicable to a small firm, so that it can reach the point that 
you mentioned. Congresswoman, when you talked about the dis- 
proportionate burden that would fall to small business if we don’t 
aggressively address that point. That is precisely the effort that is 
under way. 

Point number three. Chairman Cox indicated, which we have just 
passed and sent to the SEC for their review, the AS 5, the 
scalability portion of that adjusted standard, specifically focuses on 
ways that we can be scalable to address the smaller and less com- 
plex businesses. 

And I think, very importantly, as Chairman Cox mentioned, the 
fact that we are now linking the AS 5 with the management guid- 
ance that have been produced by the SEC will in fact answer the 
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question that you asked at the outset, which is, will the revisions 
bring costs down. And I agree with the chairman, there is no rea- 
son why those costs should not come down because of the fact that 
we have made the standard that much more scalable and that we 
have reduced the wording that would have resulted in unnecessary 
procedures being made by the external auditor. 

As to the delay, the bill was passed, as I said, in 2002. It has 
now delayed full implementation until 2009. To delay it a year, 
until 2010, would mean that full implementation would have taken 
the equivalent of four terms in the House of Representatives. And 
I think, in our judgment as we have looked at the manner in which 
we have delayed, and particularly what the SEC has done in stag- 
ing the dates of compliance, it seems to me that there is adequate 
time built into it now for the firms to be ready. 

[The prepared statement of Mr. Olson may be found on page 56 
of the Appendix.] 

ChairwomanVEL^QUEZ. Thank you, sir. 

ChairwomanVELAZQUEZ. Chairman Cox, I know that you will not 
be able to stay to hear the testimony of the second panel of wit- 
nesses this afternoon, so I want to pose to you the question that 
I expect will be central to the second panel of witnesses. 

Will you support further postponing SOX 404 compliance dates 
for smaller public companies? 

Mr. Cox. Chairwoman, I think because this has been the subject 
of my formal testimony and also Chairman Olson’s, that I should 
ask you with respect to the upcoming panel — ^by the way I want 
you to know that the SEC will be here in full force to listen to that 
testimony — 

ChairwomanVELAZQUEZ. I understand. 

Mr. Cox. — ^but to make sure that we are addressing ourselves to 
the same question, are you focused on the 404 audit? 

ChairwomanVELAZQUEZ. Yes. 

Mr. Cox. Because I think what we have taken pains to explain is 
that while there will be required compliance with 404(a) — 404 is 
very short, it has part (a) and part (b), and 404(a) compliance will 
kick in for smaller companies in 2008 and 404(b) won’t kick in 
until filings in 2009. 

ChairwomanVELAZQUEZ. And I will have a question for you in 
terms of those dates. 

Mr. Cox. Right. 

And so is what you are asking, are we thinking about 2010? 

ChairwomanVELAZQUEZ. Well, Mr. Chairman, in reading the tes- 
timonies that will be presented here this afternoon and in the 
meetings that we have had with the sectors that will be impacted 
by this, it seems that small companies do not feel that because they 
will have until 2009 to comply with the PCAOB — that the problem 
is that in order to comply with the SEC in 2008, they will have to 
incur expenses that have to relate to 2009. 

And I am going to ask you this question so that you can see why 
there is so much concern, not about the fact that you are coming 
here and saying, "But they will not have to comply with those 
guidelines until 2009," but in order to comply, for the 2008 reports 
that they have to present to SEC in 2008, they will have to incur 
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expenses that are supposed to be related to the reports that they 
have to submit to the PCAOB in 2009. 

In your testimony — 

Mr. Cox. Madam Chairwoman — 

ChairwomanVELAZQUEZ. I am going to try to explain in this 
question. 

In your testimony you highlight that a further delay in the com- 
pliance date is at this point unnecessary. Explaining this point, you 
emphasize that small companies will not have to come into full 
compliance until March 2009. This reasoning assumes, however, 
that management is willing to sign annual reports for fiscal years 
ending on or after December 15, 2007, without an outside auditor’s 
review. 

Because of reasonable concerns about potential liability associ- 
ated with information included in such reports, I expect that the 
December 2007 deadline is likely to force a number of smaller pub- 
lic companies to implement both the SEC’s and PCAOB’s new 
standard during the second half of 2007. 

Do you agree that this is a likely consequence of the SEC’s exist- 
ing SOX compliance timeline for smaller firms? 

Mr. Cox. No, Madam Chairwoman, but I think it is very useful 
to have that question asked publicly and answered publicly. 

That is not at all the intention of what the SEC is doing, nor is 
it the intention of what the PCAOB is doing, I think fair to say, 
although I will let Chairman Olson comment for the PCAOB. 

What we are seeking to do is completely the opposite, and that 
is to stage compliance for smaller companies. There is absolutely 
no question, given all of the evidence that we have received — and 
as you know, we have been very carefully consulting with small 
businesses across America in a variety of formal ways. All of the 
evidence that we have received suggests that the costs that are of 
particular concern in Section 404 compliance relate to the 404 
audit. As a result, by letting management for the first time have 
guidance directly from the SEC on what it should do as a com- 
pany — not relying on its auditors, but what it should do to assess 
its own internal controls — and to be sure that its style is scaled for 
smaller companies so that their approach needn’t be the same as 
it is for a large company, we think that they will have a very dif- 
ferent opportunity than they would have had if they had to comply 
with what I am going to call "old 404" and "old AS 2." after they 
have a year’s experience with that process and after they get to 
watch other larger companies work with the new standard, AS 5, 
then and only then would they be required to file, themselves, fi- 
nancial reports that include as part of the integrated audit a 404 
audit. 

ChairwomanVELAZQUEZ. Mr. Olson, you don’t see the concern 
coming from small companies regarding compliance with PCAOB’s 
and expenses that they will have to incur in order to comply with 
SEC by the year 2008? 

Mr. Olson. Well, we do see the concern. I think a number of 
things have been done to alleviate — I think the concern and the 
linkage between the management guidance that the SEC has just 
come out with on their 404(a) and the new audit standard that we 
have done on 404(b) help address that issue. 
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I think it is very important because the management guidance 
was designed as guidance for management, obviously. And what 
that guidance does is to outline for the management of a company 
that is already very much aware of the internal control environ- 
ment that they have. And for the companies that already have good 
internal controls, the management guidance will still be that im- 
portant guidance; but for companies that have postponed taking a 
careful look at their internal control environment, this will tell 
them what management is to do. 

And as you indicated, they will be required to file that a year 
from now. Then the external auditor, which is the standard that 
we have provided — the external auditor will then have until the fol- 
lowing year to have completed the audit. 

Part of what was not addressed — and I think that this is part of 
the concern — is that in the AS 2, the AS 2 guidelines which were 
very specific were sometimes taken as the de facto standard for 
management. What the SEC has done now is to give them a much 
more manageable guideline that I think will help address that con- 
cern. 

ChairwomanVELAZQUEZ. Well, let me ask you both, didn’t you 
think that small companies will seek an outside audit opinion in 
order to sign off on the submissions, as requested by the SEC? 

Mr. Cox. Of course they will have audited financials. 

ChairwomanVELAZQUEZ. But you said that, no, the costs will be 
lower since they don’t have to comply until 2009. But in order to 
comply with the report that they have to send to you, they will 
have to seek an outside auditor’s opinion. 

Mr.Cox. But that audit, just to be clear, if we are talking about 
2007 and 2008, that audit will not be a 404 audit of the company’s 
internal controls, but rather it will be the financial audit that is 
necessary for all public companies and has always been necessary 
for smaller public companies. 

ChairwomanVELAZQUEZ. Let me ask you, in your testimony you 
confirm that the new standards will reduce SOX 404 compliance 
costs for small firms. In this afternoon’s second panel, we will hear 
testimony from experts indicating that it is impossible to know 
whether compliance costs will go down until the new standards are 
implemented in a small business environment. 

Can you share with the Committee how you know that the new 
standards will lower compliance costs for smaller companies and by 
how much you expect the compliance costs to decrease? 

Mr.Cox. Well, of course the benchmark for measuring any reduc- 
tion that might be anticipated in compliance costs has to be what 
it costs today to comply. There are companies, including companies 
with a below-$75 million public float that have, for whatever rea- 
son, come into compliance early, and those companies provide a 
benchmark. There is absolutely no question that AS 5 is going to 
be more flexible for the reasons that I outlined, more top-down, 
more risk-based, more materiality focused and more scalable than 
it is predecessor, AS 2. 

For all of those reasons compliance is going to be much less cost- 
ly. The necessity for what I would consider to be redundant, unnec- 
essary or immaterial work will be eliminated. The focus will be on 
what truly matters. 
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This is not to say that it will be a cost-free exercise. But what 
we are seeking to do is bring the costs more in alignment with the 
benefits. Since this is real work, it is intended to produce real bene- 
fits. The investors are paying; the investors deserve those benefits. 

ChairwomanVELAZQUEZ. But you come here, sir, and you testify 
to the fact that this is going to lower compliance costs, that they 
will go down. In 2003, the Security and Exchange Commission fore- 
cast that the average cost of SOX compliance will be $91,000; this 
forecast proved to be a significant underestimate of the actual com- 
pliance costs. 

My understanding is that the SEC intends to release the new 
management guidance and auditing standard without a cost esti- 
mate. Can you tell us why this is? 

Mr. Cox. In fact, the cost-benefit analysis that the law requires, 
that the Regulatory Flexibility Act requires, will be included as 
part of our submission to the Office of Management and Budget, 
which I believe we are making today — if not today, it will be tomor- 
row. 

And with respect to that 2003 analysis of what SOX compliance 
was expected then to cost, as you know, in 2003 I was a Member 
of the House of Representatives and a member of the Financial 
Services Committee; and like you, I voted for the legislation with 
the understanding that Section 404 would provide great benefits to 
the country and to investors and then would not be unduly burden- 
some or cause waste. 

The evidence that we have all seen since then indicates that not 
only was that estimate wrong, but I think our estimation as legisla- 
tors of what was going to happen in consequence of 404, modeled 
as it was on FDICIA, was also in error. And that is why I am so 
firmly convinced that this needs to be changed to bring it into 
alignment with congressional intent. 

ChairwomanVELAZQUEZ. Well, I am a member of the Financial 
Services Committee, and I do support the spirit of the law. And we 
all know the problems that we saw in terms of corporate America 
scandal. We understand that. 

In my role as the Chair now and ranking when we passed the 
law, I consistently raised the issue about the impact that Section 
404 would have on small companies. The fact of the matter is that 
we have the Regulatory Flexibility Act that requires for agencies 
to conduct a full economic analysis, impact analysis of the regula- 
tions. What we have seen and what we have read about the regu- 
latory flexibility analysis that you have conducted, it looks to me 
to have been quite limited; and we are concerned about that. 

So I would like to see if you have more data or information as 
to the regulatory flexibility analysis that you conducted to share 
with this Committee. 

Mr. Cox. Well, of course we will share with the Committee any 
analyses that we have that you think would be of interest to you. 
Beyond that, I think it is important to point out that because we 
are staging compliance for smaller companies differently from larg- 
er companies who will have to come into compliance in 2008, we 
will have the benefit of that year. And if the Commission learns 
that our estimations are in error, that what we intend to happen 



13 


is not what is happening, then we will have the opportunity to con- 
sider further postponement of compliance. 

ChairwomanVELAZQUEZ. I am glad to hear that. 

And now I will recognize Ranking Member Chabot. 

Mr.CHABOT. Thank you, Madam Chairwoman. 

And, Chairman Cox, I will begin with you if I can. Would you 
review for us what educational efforts the Commission is under- 
taking for small businesses to make them more aware of the new 
Sarbanes-Oxley Section 404 compliance requirements? 

Mr.Cox. I would be pleased to do that. 

We are right now in, essentially, the planning stages for that ef- 
fort because we don’t yet have a new standard that is in effect. And 
our management guidance, while it is, as I mentioned, going to be 
404(b), the review will not be completely final for a short while. 
When that occurs and when we can go out and talk about our new 
management guidance and our new audit standard, we intend to 
have a special focus on communicating with small business, not 
only in the usual ways through speech making and our liaison with 
small business, but also through our Office of Investor Education 
and Assistance. 

We hope to prepare brochures that will be specially designed for 
small business to accompany the management guidance, which al- 
ready was written with small business in mind, meant to be flexi- 
ble and so on. And I will do everything that I can in a small busi- 
ness friendly way to communicate in ways that small business can 
understand without hiring expert help. 

Mr.CHABOT. Thank you. 

Should the SEC be concerned that some small businesses are de- 
ciding to list their stocks on foreign exchanges in order to raise 
capital and avoid compliance with Sarbanes-Oxley Section 404? 

Mr.Cox. Yes. There is no question that when companies list in 
the United States that are stronger investor protections. And so to 
the extent that U.S. investors are going to end up owning any of 
these issues, we are all better off from an investor protection stand- 
point if that activity occurs in the United States. 

So we are focused, as you might imagine, on ensuring that our 
regulations and our entire theme is focused on getting the max- 
imum amount of investor protection with the maximum amount of 
activity in U.S. capital markets. 

Mr.CHABOT. If the Commission prepared a final regulatory flexi- 
bility analysis, did it estimate the cost of compliance for small com- 
panies seeking to go public? 

Mr.Cox. While we do not have a dollar figure attached to that, 
it is, as I mentioned, because we will have the benefit of a year of 
real-world experience before that requirement kicks in. 

Mr.CHABOT. I yield to the chairwoman. 

ChairwomanVELAZQUEZ. In order to comply with the Regulatory 
Flexibility Act, you have to do a full cost analysis, so where is the 
cost? 

Mr.Cox. We did in fact comply fully with the requirements of the 
Regulatory Flexibility Act, including Section 607. 

ChairwomanVELAZQUEZ. But then you have a cost. What will be 
the cost for small companies to comply? 
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Mr.Cox. Well, all I can tell you beyond that, because I have been 
assured by both the Commission’s counsel and the Division of Cor- 
poration Finance that this is the case, that the very same package 
that we are providing to 0MB, I believe this day, we will be able 
to happy to provide in real time to the Committee. 

ChairwomanVELAZQUEZ. And will you commit with this Com- 
mittee that if it doesn’t have a full cost analysis, compliance will 
be delayed until such an analysis is conducted? 

Mr.Cox. Yes, of course; and compliance is already delayed. But 
I will absolutely assure this Committee both today and prospec- 
tively that we will be in full compliance with the Regulatory Flexi- 
bility Act. 

Mr.CHABOT. Reclaiming my time, Mr. Olson, I will turn to you 
now if I can. 

There is no doubt that the audit standard requires a fair amount 
of exercise of independent accounting judgment by auditors. What 
is the likelihood that the exercise of such judgment will increase 
the cost of audits? 

Mr. Olson. Congressman, there is an element of accounting judg- 
ment that goes into many accounting transactions, and — because 
even as precise as our accounting standards are, there still is a sig- 
nificant amount of judgment it involves. 

The role of the PCAOB when we do the inspections is that we 
look at the manner in which the accounting has been audited. So — 
it is the audit component of it that we look at, and so what we do 
is, we look at the extent to which the auditing standards have been 
followed with respect to the accounting, and where we see account- 
ing treatment that we think is questionable, it is at that point we 
refer that to the SEC. 

But — it is the audit component that we look at, but one of the 
reasons, as I think you are pointing out — and it takes a great deal 
of skill to do this — is the fact that there is a lot of judgment re- 
quired in many of the accounting treatments. 

Mr.CHABOT. Thank you. 

Will the board entertain recommendations from smaller compa- 
nies and their auditors as they gain experience with the new audit 
standard in an effort to further reduce the cost of the audit stand- 
ard? 

Mr. Olson. We meet continuously with the accounting profession, 
with the audit profession, in a number of venues; and our examina- 
tion process is very dynamic, which is to say that we are changing 
it continuously as we learn more. 

You may remember, as you know, that we are a 4-year-old orga- 
nization; we have completed 3 full years of doing inspections, and 
it was an inspection methodology that we had to build from 
scratch. So we have been developing that continuously and we have 
been working to improve it continuously. As we have learned more 
and as the environment has changed, and more importantly, as the 
auditing profession has changed, we have changed our approach 
too. 

So the answer to that is definitely "yes." 

Mr.CHABOT. Thank you. I am pleased to hear that, and I would 
strongly encourage the board to take into consideration what the 
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small business folks and the auditors say as time goes on, as they 
become more familiar with it. 

And so I am glad to hear that. 

Madam Chair, I yield back the balance of my time. 

ChairwomanVELAZQUEZ. Ms. Clarke. 

Ms. Clarke. Thank you very much. Madam Chair, for holding 
this hearing today on this very critical issue. We must ensure that 
these new guidelines being discussed today provide small business 
the relief they so desperately need. 

I would like to also just sort of highlight. Madam Chair, your 
focus on the unintended consequences of this timeline that is set 
forth to implement AS 5 and the management guidelines. The roll- 
out is where we really need to focus right now, and I think that 
has been some of what you have been hearing from the Committee. 

Chairman Cox, I wanted to ask that while the SEC approved 
new management guidelines on May 23 to help navigate the bur- 
densome provision of the Sarbanes-Oxley Act, your administration 
said it was not necessary to give smaller companies additional time 
to comply with Section 404. But now it appears, based on your tes- 
timony here today, that you are willing to reconsider your decision. 

Can you explain to us, why the sudden change in your position? 

Mr. Cox. Well, I don’t believe that I have been articulating dif- 
ferent positions. I am merely trying to make it clear that there are 
different timelines in place. 

The management guidance that we are talking about is a sepa- 
rate piece from AS 5, which the PCAOB is talking about. That is 
going to go into effect a year later for smaller companies, so we al- 
ready have a built-in delay until 2008 for management guidance 
and 2009 for AS 5, the PCAOB’s audit standard. 

And then, in response to the Chairwoman’s question about what 
would happen if we learned as a result of the built-in year of expe- 
riential base that we will have looking at AS 5 being utilized by 
our companies, if that doesn’t turn out as we intend, would we then 
consider further extension, the answer to that is absolutely "yss." 

And that has been our view consistently. We expressed that at 
our recent public meeting. I think all the Commissioners are of 
that view. It is expressed in the formal written testimony that we 
provided though this Committee. 

And by the way, because we are a five-member commission and 
that written testimony presented, it has been voted upon and ap- 
proved by all five commissioners. So I think I speak very much for 
all members of the Commission that is our view. 

Ms. Clarke. And let me ask, you told Congress that your admin- 
istration would not require smaller public companies to have a Sec- 
tion 404 audit until the new guideline and the new auditing stand- 
ard were available. 

Now that you are reconsidering delaying the rules, what stand- 
ards will you examine to develop effective guidelines for small busi- 
nesses? Has that been identified? 

Mr. Cox. Well, in fact the very guidance that we are talking 
about hasn’t yet gone into effect. No smaller companies yet had the 
benefit of it, and we don’t have any empirical basis to know wheth- 
er it is achieving its intended result. But very soon we will. And 
we have done our level best at the SEC, and I assure you at the 
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PCAOB, that people have been working very, very hard on this 
with small business uppermost in mind, to make sure that this, un- 
like what preceded it, which in the case of the SEC was absolutely 
nothing — there was no guidance for management and people had to 
rely for the guidance on auditors — and in the case of the PCAOB 
was AS 2, that this will be much better and different. 

And so we will soon benefit from all of that from companies that 
have already had to comply with SOX 404. And as I said, I strongly 
believe this is going to result in lower costs for them. That is the 
intent. It should. 

And then a year later, when smaller public companies come on 
line, they should have the benefit of all of that experience and 
knowledge, and we should be very highly confident at that point 
that this is going to work as intended. 

Ms. Clarke. Well, I would like to suggest, Mr. Cox, that you 
make sure that this Committee is briefed as you go along through 
this process; and that the triggers that are in place to alert your 
agency as to whether there is going to be an undue burden, that 
you closely monitor that. 

I think that SOX 404 is critical. It is very important to the inves- 
tors and to the public trust. However, we don’t want to sink busi- 
nesses in the process that are not at a capacity to be able to absorb 
these new regulations in a way in which it will be meaningful for 
their entry into the public arena in providing us with the goods 
and services that we require as a nation. So I hope that you will 
really monitor that very closely. 

Thank you very much. Madam Chair. 

ChairwomanVELAZQUEZ. Mr. Larsen. 

Mr. Larsen. Thank you. Madam Chair. 

Just a few questions. Chairman Cox. Glad to have you before the 
Committee. I am sure you are enjoying it as much as we are. 

A quick question; this is certainly related to Mr. Chabot’s ques- 
tion about investor protection versus the listing in foreign exchange 
markets. Are you seeing, assuming it has a relationship to what we 
are dealing with, but maybe not direct, maybe indirect — are you 
seeing a difference between new listings being more predominantly 
focused on foreign exchange markets versus a migration of existing 
public companies? Rather than choosing to enlist here for their ini- 
tial public offering, choosing somewhere else versus existing public 
companies seeking to raise dollars elsewhere or list separately 
overseas, is there a difference at all in that which you are seeing 
as a result of SOX? 

Mr. Cox. Well, the focus has been on IPOs. And of course it is 
much easier to make that election up front. But particularly with 
respect to smaller companies we have not seen a great deal. 

There is no question that the vast majority of offerings occur in 
the United States and not oversees, albeit if one takes a look at the 
percentage changes in overseas markets, such as AIM, you will see 
the trend is up. 

Mr. Larsen. With regards to the management guidance and AS 
5, I just want to get this straight. 

What exists to ensure that the 404 guidance and AS 5 won’t mi- 
grate to companies above the line? That is, we want to ensure that 
small businesses can comply so we are giving them some extra 
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time. Can we be assured that — obviously we want SOX to be imple- 
mented for the reasons we saw a couple of years back; can we be 
assured that no one else is going to come and try to raise that line 
of who has to comply? 

That is, it is going to be focused on small businesses for the 
delay, and as we see this thing test out, can we be assured that 
higher cap companies aren’t going to return and say, well, we want 
in on this too, we want to be delayed too? Because we are seeing 
problems with some of these smaller companies and we experience 
the same delays, can we be assured that the SEC is going to stay 
focused on moving forward with SOX compliance? 

We are really only talking about helping out the small business 
side on this. 

Mr.Cox. In fact we were talking about helping out all companies, 
but as you point out, in a very different way. 

With smaller companies it has been through deferral while we 
craft a better, more suitable standard that they could comply with 
in a scalable way. With larger companies they are already in com- 
pliance with 404; they have had to comply. And so what we are 
doing for them is changing what had been an overly complicated 
and overly expensive and cumbersome standard to one that is more 
flexible and more focused on the true material risk about which in- 
vestors care the most. 

And so, in that way, I think that the new standard will benefit 
companies of all sizes. But there is no reason to think that we are 
going to take companies that are already in compliance and tell 
them they can come out of compliance. 

Mr. Larsen. Thank you. Madam Chair. 

ChairwomanVELAZQUEZ. Mr. Ellsworth. 

Mr. Ellsworth. Madam Chairwoman, I don’t have any questions 
for this panel. 

ChairwomanVELAZQUEZ. I do have more questions. Mr. Olson, 
the Advisory Committee on Smaller Public Companies to the Secu- 
rities and Exchange Commission and the biotechnology, electronics, 
semiconductor, telecommunications and venture capital industries 
have all recommended that the new standards should include a 
revenue filter. As I understand it, the new standards employ nei- 
ther a gross revenue number nor an indicator, like product rev- 
enue. 

Why did the SEC and PCAOB opt not to follow the recommenda- 
tions of the advisory committee? 

Mr.OLSON. That is a very good question. We looked at the extent 
to which we could make the standard scalable particularly for 
small business, and as you may recall, in the standard that we 
have produced in December the whole portion on scalability was fo- 
cused on small business. 

And as we looked at that carefully the debate that went on was 
whether or not — what were the thresholds or what were the 
metrics that would determine whether or not a firm should be in 
one category or another. And what we carefully wanted to avoid 
was having what we would call buckets, that we would pull this 
amount of revenue or this amount of revenue and then have that 
apply to everybody in that category. 
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What we wanted to do instead was to have a standard that was 
idiosyncratic; that is to say, that could focus on the size and com- 
plexity of that individual company. And the manner in which the 
standard is now written, it is part of the auditor’s responsibility to 
define at the outset the extent to which size and complexity impact 
the manner in which they have scoped the audit. 

So I think that in fact we have addressed it in a way that will 
be more applicable to the specific needs and the specific size and 
complexity of the entity itself. For example, I know that there are 
some very small banks, not very many of them, but there are some 
very small banks that have very complex balance sheets, and they 
will take one sort of internal controls. There are also some very 
large companies that are relatively not complex and the control 
structure that they would put in place ought to reflect that. 

With particular respect to the technology industry what you tend 
to get is some very well-capitalized companies that have very low 
revenue. I think for that reason they are saying we in fact should 
be put in a category with some smaller firms. 

In effect, we have done that by the manner in which we have 
redone the scalability section by removing the small business focus 
and making it applicable to entities of all size. 

ChairwomanVELAZQUEZ. Chairman Cox, would you like to com- 
ment on that? 

Mr.Cox. Just technically, the SEC has not yet voted on ASS. We 
will have an opportunity after exposure to public comment to do so. 
So far we have been able to collaborate with the PCAOB on draft- 
ing it, and I am certainly very familiar with the discussion that you 
just had. 

ChairwomanVELAZQUEZ. Mr. Olson, since the new standards are 
principle-based and provide flexibility for auditors to employ their 
professional judgment, the standards will create significantly lower 
compliance costs only if they are implemented properly. This 
means that the PCAOB’s efficiency inspectors have a very impor- 
tant role to play if the new standards are to result in lower SOX 
404 compliance cost. 

So my question is how many efficiency inspectors doesPCAOB 
have on staff and what month would the PCAOB begin inspecting 
audited firms’ implementation of the new standards? 

Mr. Olson. First of all, you are exactly right. In terms of the im- 
plementation, it is my sense that we have the words right in the 
new standard and the key to it being more cost effective is the im- 
plementation. 

With our inspections of auditing firms, the inspections include 
right now that we look at the efficiency and the effectiveness on the 
audit of internal controls over financial reporting only for those 
companies at this point, of course, that are the accelerated filers. 
The same people do both. And there are about 250 that we have 
in the field right now who are doing those inspections. 

ChairwomanVELAZQUEZ. Two hundred fifty. 

Mr. Olson. Two hundred fifty. When we get to the point — and, 
remember, it is the expectation that as the audits are done that 
these will be integrated audits, so the audit of internal controls and 
the financial audit will be done in an integrated fashion. So it is 
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important as we look — as we go out and do the inspections that we 
are looking at both simultaneously. 

We would like to have in the area of 300 or so inspectors. We 
think at that level we will have a full complement. That is not ex- 
actly a fungible commodity out there, people with audit experience, 
so we are having trouble finding enough good people. 

ChairwomanVELAZQUEZ. Chairman Cox, both the PCAOB and 
SEC have used the term "right size" to describe what the recent 
revisions will do to audits. What is meant by this term and what 
do you envision a success? 

Mr. Cox. This is related to the discussion that the Chairman and 
Madam Chairwoman just had about complexity. Companies come 
in all different shapes and sizes. The check-the-box mentality was 
thought to be the Achilles heel of AS2. ASS takes a completely dif- 
ferent approach. Our guidance for management takes this same 
principle-based approach and also permits reliance on judgment, 
reliance on the work of others. It permits focus on materiality, on 
things that truly matter to the financial statements. 

By focusing on the control environment of a particular company 
and making sure that what management understands it is tasked 
to do is to assess its internal control system, not to design an inter- 
nal control system that is reverse-engineered for the audit, it is 
going to make a hig change. 

ChairwomanVELAZQUEZ. What do you envision a success? How 
would you measure it? 

Mr.Cox. In two ways. We hope to get higher-quality financial 
statements because we are focusing on the jugular and no longer 
focused on the capillary. We are also hoping to reduce the cost of 
compliance. This is not alchemy. 

ChairwomanVELAZQUEZ. But you don’t have the cost yet, the cost 
of compliance, do you have it? 

Mr.Cox. We certainly have current costs and we will very quickly 
have empirical evidence about costs under the new standard and 
the new guidance. 

ChairwomanVELAZQUEZ. I am sorry; what was your answer 
about the fact that you don’t have a cost for compliance? 

Mr.Cox. It is our estimate that costs will be significantly lower 
for the reasons that we described. The precision of our estimate is 
going to be in the putting, if you will — that is to say, since compa- 
nies are already in compliance with a standard that we believe is 
more difficult than what we are replacing it with, there is no one 
who has worked on this that doesn’t believe that costs ought to 
come down. This is the purpose of the exercise. 

ChairwomanVELAZQUEZ. If it doesn’t come down? 

Mr.Cox. Then of course we will revisit it immediately. 

ChairwomanVELAZQUEZ. What would be the time line for that? 

Mr.Cox. With respect to smaller companies, which I know you 
are focused on intently in this Committee, the point of having an 
opportunity to look at this for a year first is so that we will have 
the benefit of that experiential base. 

ChairwomanVELAZQUEZ. Okay. Any other member has a ques- 
tion? Mr. Chabot. 
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Mr.CHABOT. Thank you, Madam Chair. In the interest of getting 
to the next panel I will just have one final question here, and ei- 
ther or both of the witnesses could answer if they want to. 

Do you believe that the audit standard places the proper empha- 
sis on fraud risk, or should the standard be further amended to im- 
pose a greater focus by the auditors on fraud risk? Either one or 
both are welcome. 

Mr. Olson. Congressman, one of the significant revisions that we 
made in the final draft was to move up within the standard itself 
the focus on fraud risk, because we think that is very important 
and we wanted to make sure that the standard highlighted the pro- 
cedures that they ought to be taking in order to attest for fraud 
risk exposure. 

So I think with respect to the audit component of it, have given 
it appropriate priority in the standard. 

ChairwomanVELAZQUEZ. I have a last question for Chairman 
Cox. Next month when the SEC receives public comments on ASS, 
e small business community will be able to comment on the pro- 
posed new auditing standard. So what input will be most likely to 
encourage you to support a further extension of the SOX 404 com- 
pliance for small companies? 

Mr. Cox. I think that input would have to be in parallel with 
comments on ASS because ASS doesn’t contain the schedule. I hon- 
estly don’t want to tell the small business community what they 
should be telling us. I think our point is we need to listen, we need 
to be attentive to what they have to say. But we will be. I think — 

ChairwomanVELAZQUEZ. And you will be listening. 

Mr. Cox. The important thing is that we are taking this very, 
very seriously because we know, not only for companies that are 
already public but for companies that have no publicly traded 
shares and no IPO plan, their ability to raise capital near term is 
in some measure a function of investors’ sense that someday they 
will be able to tap the public markets. So for companies of all sizes, 
not just those on the verge of an IPO, this is really important, and 
we understand that. 

ChairwomanVELAZQUEZ. Any other member? 

Mr.CHABOT. Madam Chair, one final question. Sorry. Mr. Cox is 
now obviously the head of the Securities and Exchange Commis- 
sion, but before — as you mentioned — that, he had a distinguished 
career here in the House of Representatives. I’m curious: Is it more 
fun to be up here asking the questions or answering them? You 
don’t have to answer that but you are welcome to. 

Mr. Larsen. I am sure it is a great pleasure for him to be here 
answering our questions. 

Mr. Cox. Well, you gave me the option of not answering. I will 
say being invited to a congressional hearing and offered the oppor- 
tunity to not answer questions is truly enjoyable. 

Mr.CHABOT. Thank you. I yield back. 

ChairwomanVELAZQUEZ. No other member has any comment or 
question. Then the first panel is excused and I want to thank both 
Chairmen Cox and Olson for their time, and I welcome you back. 
I especially remind you, once again, the answers that we are ex- 
pecting regarding the Regulatory Flexibility Act, full cost analysis, 
it is important for us too. 
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With that, I excuse the first panel. 

I will ask the second panel of witnesses to take their seats and 
the hearing will resume shortly. 

[Recess.] 

ChairwomanVELAZQUEZ. We are going to resume our hearing. I 
want to welcome you all and thank you for your patience. 

So our first witness is the Honorable James C. Greenwood. He 
is President and CEO of the Biotechnology Industry Organization 
in Washington, D.C., which represents more than 1,100 bio- 
technology companies. Prior to that he represented Pennsylvania’s 
Eighth District in the U.S. House of Representatives from January 
1993 through January 2005. While serving in Congress Mr. Green- 
wood was a leader on health care issues, authoring numerous bills 
signed into law, including legislation to promote pediatric labeling 
for pharmaceuticals and reform medical device review and ap- 
proval. You are welcome. It is good to see you back here in the 
House of Representatives. You will have 5 minutes to make your 
presentation. 

STATEMENT OF JAMES C. GREENWOOD, PRESIDENT AND CEO, 
BIOTECHNOLOGY INDUSTRY ORGANIZATION (BIO) 

Mr. Greenwood. Thank you very much. Chairwoman Velazquez, 
Ranking Member Chabot, and other members, I thank you for pro- 
viding the opportunity for us to testify before you today on reforms 
to the Sarbanes-Oxley section 404 adopted by the Securities and 
Exchange Commission and the Public Company Accounting Over- 
sight Board. 

I am Jim Greenwood, President and CEO of the Biotechnology 
Industry Organization. I am privileged to be here today on behalf 
of BIO, an organization, as the Chairwoman said, of more than 
1,100 biotechnology companies, academic institutions, and other or- 
ganizations in all 50 U.S. States and 31 nations. 

The promise of biotechnology is immense, as our members com- 
bine in biology and technology to deliver new treatments for unmet 
medical needs, improved crops that are more drought-resistant and 
have reduced environmental impact and create cheaper, more envi- 
ronmentally friendly fuels and consumer products. Biotech is one 
of the most innovative, high-growth sectors of our Nation’s economy 
and one in which the IJnited States maintains global leadership. 

First, I would like to start by providing a short answer to the 
Committee’s question posed in the title of this hearing as to wheth- 
er or not we believe the SECs and PSAOB’s new standards will 
lower compliance costs for small companies. In summary, it is a 
marginal "yss." as this Committee well knows, it has been the im- 
plementation of section 404 that has gone awry. 

The situation that many emerging biotech companies face is that 
funds that would be otherwise spent for core research and develop- 
ment of new therapies for patients are instead having to be used 
for overly complex controls or unnecessary evaluation of controls. 
As a conferee for this legislation in 2002, I know it was not in- 
tended to be a windfall for auditors nor pile on the compliance 
costs for small companies. 

The scale of the problems that section 404 has created suggest 
that Congress should closely monitor the implementation of these 
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revisions to ensure that its original intent is achieved. It is critical 
to ensure that these new rules provide the greatest possible flexi- 
bility and scalability for small public companies. 

For most biotech companies, the actual cost of section 404 com- 
pliance, including both internal cost as well as external auditor 
costs, are substantial. In fact, the opportunity costs of section 404 
for smaller companies can be even greater, impeding the ability to 
invest in and, in some cases, to continue critical research and de- 
velopment activities for treatments of an array of diseases from 
cancer to multiple sclerosis. 

The current problem with section 404 are not merely growing 
pains. Current implementation of section 404 imposes the same re- 
quirements, steps and reviews by the same individuals year after 
year. The Commission and the PCAOB have taken steps to address 
the problems that have manifested in the implementation of sec- 
tion 404. Both agencies suggest that these new requirements are 
to be scaled, risk-based, and flexible. While the SEC’s final guid- 
ance is not yet public, we hope that it will provide a more flexible 
principles-based set of rules for management. On the other hand, 
the new standards adopted by the PCAOB could still be improved 
to enhance flexibility and auditor judgment. 

Furthermore, one could fairly say that in its revisions to its ini- 
tial December 2006 draft, the PCAOB has actually taken a step 
backward. 

Included in both the Commission’s and the PCAOB’s draft pro- 
posals were objective measures auditors could use in determining 
what is a smaller company, mainly one with a market capitaliza- 
tion of less than $700 million and reported annual revenues of 
$250 million or less. This was consistent with the recommendation 
of the Advisory Committee of Small Public Companies. Who sug- 
gested that an objective test, particularly a revenue filter, be used 
as a tool to define a smaller public company than scaling the audit. 
Unfortunately, this definition of the small company has been re- 
moved from the final PCAOB-adopted rule. 

Rather than maintaining the proposed objective definition of a 
smaller company and then expanding it to include the subjective 
criteria that could also be applied to parts of larger companies, an 
approach which BIO supports, the PCAOB removed the objective 
criteria altogether, and that is our largest complaint. By elimi- 
nating any reference to market capitalization or annual revenues, 
the PCAOB has taken away the only objective criteria for 
scalability included in the rule. In doing so, PCAOB appears to 
have moved from the presumption that a company meeting those 
thresholds is a small company that should be subjected to a scaled, 
less burdensome audit, to a presumption that every enterprise 
should be subject to the fullest, most comprehensive audit, unless 
the auditor determines otherwise using the subjective criteria in 
the rule. 

As a result of this change BIO believes that the new standards 
may do less than the PCAOB’s initial December 2006 revisions to 
counterbalance the incentives for auditors to be overzealous in 
their work. Consequently, while we were hoping for greater relief, 
it is now clear that PCAOB rules will lead to substantially lower 
audit fees or reduced burden on emerging biotech companies. 
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BIO has consistently advocated for scalability indicia that are 
most reflective of complexity, and we still believe that both the 
SEC and the PCAOB should recognize product revenue as an im- 
portant indicator of complexity. 

In addition, BIO member companies have raised concerns that 
after changing auditors they experience new interpretations of ma- 
terial weakness. Even within the context of a principles-based ap- 
proach to auditing, some further clarification on this guidance is 
needed. BIO believes that clarification in the PCAOB-adopted rule 
should accomplish this. 

Lastly, we strongly believe that a rigorous economic study of the 
costs and benefits associated with the implementation of section 
404 is imperative to understanding if the current reform proposals 
are meeting the objectives, and I believe that the SEC analysis is 
qualitative and not quantitative, in answer to the Chairwoman’s 
questions. We urge the SEC to provide an additional exception for 
non-accelerated filers. The Commission has the ability to make the 
much needed changes that we have mentioned. 

In conclusion, BIO appreciates the efforts that both agencies 
have taken to improve SARBOX implementation. It is unclear, 
though, whether these reforms will fully match the rhetoric sur- 
rounding their adoption. However, we remain hopeful that this is 
just the first of several steps that both the PCAOB and the SEC 
will take in reducing the unnecessary burdens of Sarbanes-Oxley 
on America’s emerging and innovative companies. 

I thank you for your time and your consideration of BIO’s views 
and I would be happy to answer any questions. 

ChairwomanVELAZQUEZ. Thank you. 

[The prepared statement of Mr. Greenwood may be found on 
page 75 of the Appendix.] 

ChairwomanVELAZQUEZ. Our next witness is Diane Casey- 
Landry. She is President and CEO of America’s Community Bank- 
ers, a national trade association committed to strengthening the 
competitive position of community banks. Prior to joining ACB in 
2000, Ms. Casey-Landry served as Principal and National Director 
of Financial Services for Brand Thorton LLP. Her past experience 
also includes serving as Executive Director of the Independent 
Community Bankers of America, and as a bank examiner for the 
Federal Reserve Bank of Cleveland. 

Welcome, and you have 5 minutes. 

STATEMENT OF DIANE CASEY-LANDRY, PRESIDENT AND CEO, 
AMERICA’S COMMUNITY BANKERS (ACB) 

Ms. Casey-Landry. Thank you. Madam Chairwoman Velazquez 
and Ranking Member Chabot and members of the Committee. 

I am Diane Casey-Landry, President and CEO of America’s Com- 
munity Bankers. Thank you for holding this very important hear- 
ing today and for the invitation to appear today to present to you 
our views on section 404 of the Sarbanes-Oxley Act and the recent 
changes on the management guidance and auditing standards 
made by the SEC and the PCAOP. 

America’s Community Bankers is the national trade association 
for the Nation’s community banks of all charter types and sizes. 
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Our members represent $1.7 trillion in assets, they are located 
across this country and they are both stock, public and private, as 
well as mutually owned institutions. 

Sarbanes-Oxley was a well-intentioned law, and ACB has also 
supported strong internal controls under the banking laws and reg- 
ulations. No other publicly traded company is subject to the same 
scrutiny as a publicly traded bank. Because banks have been gov- 
erned by numerous internal control reporting and assessment re- 
quirements long before Sarbanes-Oxley became law, this creates 
both unnecessary and duplicative burdens on the banking system. 

The FDIC Improvement Act of 1991 dictates bank management’s 
responsibility for financial statements and internal control assess- 
ments and attestations. This law actually served as the model for 
section 404. However, the implementation of 404 has been much 
more costly and burdensome. 

As a meaningful reduction of this burden, ACB is supporting 
H.R. 1508, which has been introduced by Representatives Greg 
Meeks and Tom Feeney, which would create an exception from Sar- 
banes-Oxley section 404 based on a company’s size. We are also 
supporting, similarly, the provision in H.R. 1869 which would re- 
lieve community banks with up to $1 billion in assets from the 
costly internal controls attestation reports of Sarbanes-Oxley, a 
similar change which was made by the FDIC 2 years ago for the 
FDICIA banks and which ACB had requested. 

We applaud the efforts of both the Commission as well as the 
PCAOB to improve the implementation and reduce the compliance 
costs of section 404 through this principles-based approach. We are, 
however, very disappointed that the SEC decided against a further 
extension of the compliance states for non-accelerated filers despite 
several requests for such a delay, including one from this Com- 
mittee. Accelerated filers have had 3 years of experience with the 
implementation process and they are the best able to incorporate 
changes brought about by the SEC and the PCAOB’s recent action. 

Community banks that are non-accelerated filers are very much 
concerned about the cost and burdens of compliance. Non-acceler- 
ated filers are the very companies that can least afford to add per- 
sonnel, consultants and systems to comply with section 404. This 
is particularly true if the Commission’s new management guidance 
and the PCAOB’s revised auditing standards prove unsuccessful in 
reducing the costs and other burdens associated with implementing 
section 404 as a result of the actions by the accounting firms who 
have to implement these changes. 

With the filing deadline just 6 months away, we remain hopeful 
that additional consideration for a reasonable 1-year extension be 
given on this important issue. We are also calling upon the Com- 
mission to update the Exchange Act threshold for registration OF 
a public company from the 500 shareholder level that was first im- 
posed in 1964. Changes in market composition and participation il- 
lustrate a need for the threshold to be moved to a much higher 
range in order to provide overdue regulatory relief for smaller com- 
panies that choose to be public but choose not to be listed on an 
exchange. 

Much has been said about the impact section 404 has on our cap- 
ital markets and on our Nation’s ability to compete, and the situa- 
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tion is really very grim from the standpoint of small companies. 
Section 404 compliance costs have caused many companies to ei- 
ther remain private or to consider going private because the costs 
associated with being a public company outweigh the benefits. For 
community banks, mergers and acquisitions are frequently moti- 
vated by regulatory burden and they often cite section 404 of Sar- 
banes-Oxley. 

For example, as of today, the America’s Community Bankers 
NASDAQ index is comprised of 517 banking companies. It has a 
market capitalization of $193 billion. Every year since the index in- 
ception in 2003, approximately 50 companies have left the index 
primarily because of mergers, but also because of delistings. ACB 
has estimated that as many as 20 percent of the departures each 
year from the index are because of a decision to delist, triggered 
primarily by efforts to reduce burdens created by Sarbanes-Oxley. 
And when community banks disappear, local communities lose. 

Notwithstanding the importance of internal controls, there must 
always be balance with the costs and burdens imposed on smaller 
public companies, and part of achieving this goal is to reduce the 
amount of unnecessary regulatory burden hampering the ability of 
small companies and small community banks to compete domesti- 
cally. 

I very much appreciate the opportunity to appear before you 
today and for your continued work on this important issue and I 
would be pleased to answer any questions you will have. Thank 
you very much. 

ChairwomanVELAZQUEZ. Thank you very much. 

[The prepared statement of Ms. Casey-Landry may be found on 
page 84 of the Appendix.] 

ChairwomanVELAZQUEZ. Our next witness, Mr. Hal Scott. He is 
the Nomura Professor of the Program on International Financial 
Systems at Harvard Law School. He teaches courses on inter- 
national finance and securities regulation. Professor Scott is the di- 
rector of the Committee on Capital Markets Regulation and past 
Governor of the American Stock Exchange. Before joining the Har- 
vard faculty. Professor Scott clerked for Justice Byron White. Wel- 
come, sir. 

STATEMENT OF HAL SCOTT, NOMURA PROFESSOR, DIRECTOR 

OF THE PROGRAM ON INTERNATIONAL FINANCIAL SYS- 
TEMS, HARVARD LAW SCHOOL 

Mr. Scott. Thank you. Madam Chairwoman, Ranking Member 
Cabot, and members of the Committee. Thank you for giving me 
the opportunity to testify on this important issue on behalf of the 
Committee on Capital Markets Regulation which I will refer to, 
just to make it clear that it is our committee versus your Com- 
mittee, as the CCMR. 

I would ask that my full written statement be incorporated into 
the hearing record. 

The CCMR is independent and bipartisan, composed of 23 cor- 
porate and financial leaders drawn from the investor community, 
business, finance, law, accounting and academia. CCMR issued its 
interim report on the state of the U.S. public equity capital mar- 
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kets on November 30th 2006. The CCMR’s purpose is to explore a 
range of issues related to maintaining and improving the competi- 
tiveness of U.S. capital markets. 

In my remarks today I would like to make three central points: 

First, the debate over section 404 is a debate about the health 
and future of small business as much as anything else, because the 
costs of compliance, as you well know, fall hardest on those entities 
least able to afford them. This issue is about Main Street, not Wall 
Street, and it is important that you are focused on that. 

Second, you are right to press on the questions of costs of compli- 
ance. As I will explain in a moment, neither we nor the SEC or 
PCAOB know the answer to your question, and that is a big prob- 
lem if we are regulating in the dark on something so central to the 
U.S. company. 

Third, there is an action that the SEC can take that would be 
helpful here. It should again delay applying both its rules and the 
PCAOB’s rules to small business so we can develop a stronger fac- 
tual record on the question of cost. 

There is no denying that the costs of section 404 have been sig- 
nificant. According to the Financial Executives International, on a 
per-company basis SOX implementation costs are 4.4 million in the 
first year, 3.8 million in the second year, and 2.9 million in the 
third current year. 

Despite the trend downward, 78 percent of the 200 executives 
surveyed by FEI said the cost of SOX section 404 still outweigh the 
benefits. 

Recent actions by the SEC and PCAOB are a mixed bag. On the 
positive side, certain important improvements have been made that 
were called for by our committee. We strongly support a top-down, 
risk-based approach that allows auditors and management to make 
use of their judgment in tailoring their evaluations of controls to 
the individual circumstances of companies they audit, so-called 
scalability. 

We support eliminating the requirement for an auditor to exam- 
ine management’s evaluation process. We support the increased 
flexibility provided for auditors to rely upon the work of others and 
to limit the testing of low-risk controls. Finally, we also commend 
the PCAOB’s focus on fraud controls. 

While we are supportive of these actions, we remain very con- 
cerned about something that the agencies should have done but 
have not. They have failed to provide a quantitative standard for 
material, as applicable to both section 404 and financial statement 
audits. Our committee recommended that materiality for scoping 
an assessment should be defined as it was traditionally, in terms 
of a 5 percent pretax income threshold. This standard will be con- 
sistent with the overall risk-based approach advocated by both the 
SEC and the PCAOB. In cases where the 5 percent test would not 
be meaningful, the agency should allow companies and their audi- 
tors to exercise their reasoned judgment. 

We are very concerned that without a presumptive quantitative 
standard, the costs of compliance with section 404 will not be suffi- 
ciently reduced. 

Our committee also recommended the completion of a thorough 
cost-benefit analysis before the revised standards were applied to 
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small companies. This the agencies have not done. Instead they in- 
tend to apply the new standards to all companies, big and small, 
at the same time: 2008, the management standards; and 2009 for 
the auditing standards. 

To our way of thinking it is a real problem that no real cost-ben- 
efit analysis has been done for any companies, at least as part of 
the proposal. This appears inconsistent with the requirements of 
Sarbanes-Oxley and Administrative Procedures Act, as explained in 
more detail in my written testimony, as well as sound public policy. 

With all due respect, it is not sufficient for the SEC to release 
a cost-benefit analysis with apparently no empirical evidence after 
adopting its rule. If the agencies were to begin by only applying the 
standards to companies over $75 million in capitalization savings, 
they could field test for the cost of the standards — I know I am 
running over my time, I will wrap up shortly. They could field test 
for the cost of the standards to the smallest of these large compa- 
nies, for example, those between 75 to 100 million in market cap- 
italization. This could give us a good idea what the cost would be 
for even smaller companies. 

Bear in mind that for small companies that have been not yet 
required to apply section 404, a key issue is how much the new 
standards will bring down first-year costs. Historically, $4.4 mil- 
lion. 

Our committee found that a substantial portion of the 404 costs, 
as high as 75 percent, were due to the management’s implementa- 
tion of 404. Thus, these costs are not avoided by only deferring to 
the PCAOB auditing rule. The SEC’s management rule goes into 
effect this year for 2008 statements. 

In our view, if the SEC determines the benefits justify the cost 
after field testing, the results of this determination, both for man- 
agement and for auditor implementation, should be made public as 
part of a rulemaking procedure so that we all have a chance to see 
what the data is and to comment on it. Everyone — companies. 
Congress and the public — is entitled to know and comment on what 
the cost reductions would be. 

By the way. Madam Chairwoman, one further thought. You 
made the point, and I think quite insightfully, that it raises a sig- 
nificant problem to implement the management part of the 404 be- 
fore we implement the auditing part, because this puts the man- 
agement of these small companies in a position of having to certify 
with high liability without the comfort of an auditor review. I don’t 
think this is a tenable situation for the management of small com- 
panies to be in. Thank you very much. 

ChairwomanVELAZQUEZ. Thank you. Professor Scott. 

[The prepared statement of Mr. Scott may be found on page 93 
of the Appendix.] 

ChairwomanVELAZQUEZ. Our next witness is Mr. Mark Heesen. 
He serves as President of the National Venture Capital Associa- 
tion. Since joining NVCA in 1991 he has worked on behalf of 
NVCA’s 480 member companies to demonstrate the positive impact 
of venture capital investment on the United States economy. Prior 
to coming to the NVCA Mark was an aide to a former Governor of 
Pennsylvania. Who was that? 
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Mr.HEESEN. Dick Thornburg, many, many years ago. 

ChairwomanVELAZQUEZ. Welcome. 

STATEMENT OF MARK G. HEESEN, PRESIDENT, NATIONAL 
VENTURE CAPITAL ASSOCIATION (NVCA) 

Mr.HEESEN. Thank you very much. Good afternoon. 

Venture-backed companies accounted for 10.5 million U.S. jobs 
and $2.5 trillion in revenues in 2006. Venture-backed companies 
such as Google, Genentech, Starbucks, FedEx, Intel and Microsoft 
were all once small and privately held, waiting for the opportunity 
to go public. Today the next Microsoft is waiting, but has yet to go 
public because of burdensome SOX compliance. 

In 2006 there were only 57 venture-backed IPOs on U.S. ex- 
changes but there were also 17 venture-backed IPOs on foreign ex- 
changes, something unheard of before Sarbanes-Oxley. What is 
even more concerning is that what we are now seeing is that com- 
panies that are viable U.S. IPO candidates are deciding to be ac- 
quired instead of going public, mainly in an effort to rid themselves 
of the SOX burden. 

Imagine if Google had been acquired by Microsoft or if Genentech 
had been acquired by J&J. Perhaps the innovation would have sur- 
vived, but the market value, the jobs, the revenues all would have 
been diluted substantially. 

We commend the SEC for its recognition of the SOX problem, yet 
we do not believe that the combined SEC and PCAOB guidance 
goes far enough to effect the necessary changes to relieve the SOX 
burden for our smaller companies. We believe that three drivers 
are critical in this regard: 

First, we are gravely concerned that the accounting profession 
will not change its high-cost practices and the guidance provided 
by both the SEC and the PCAOB regarding materiality is not spe- 
cific enough to compel them to do so. 

Second, the algopathy that exists for 404 audits leaves no choice 
for small companies in terms of service providers. 

Lastly, because of these first two concerns it is imperative that 
prior to adoption all proposed measures are fully field tested to con- 
firm that they indeed will reduce costs. 

One area of guidance that we have had significant concern about 
is the determination of what is material to sound financial report- 
ing. The original SOX language set the probability threshold ex- 
tremely low. Any area in which there was, quote, more than a re- 
mote likelihood, unquote, for an error to result in a material mis- 
take on the financials was required to be examined, documented 
and reported to the company’s audit company. This language com- 
prised just about everything. 

Proposals put forth by both the SEC and PCAOB suggest chang- 
ing this language to, quote, reasonable possibility, unquote. This 
general statement does nothing to distinguish itself from the origi- 
nal language, leaves everything open to interpretation, and will do 
little to reduce costs. 

Although we support the move to enact principles-based guid- 
ance, we feel there should be an objective threshold if we are going 
to properly balance risk and cost. Since SOX was enacted, the rela- 
tionship between the Big Four accounting firms and venture- 
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backed companies has become increasingly problematic. Many of 
our small companies have lost the attention of their Big Four audi- 
tors, who are favoring larger public companies that offer lucrative 
404 auditing engagements. Those who do maintain their Big Four 
relationships do so at a 404 cost that averages close to a million 
dollars annually. 

As Sarbanes-Oxley allows only for accredited accounting firms to 
complete 404 audits, our companies are basically held hostage to 
this oligopoly. We would not have these concerns if we had any 
comfort level that the Big Four accounting firms support SOX re- 
form, but the profession has publicly warned the supporters of re- 
form that, quote, they shouldn’t expect a dramatic reduction in 
costs, unquote, with the adoption of these proposals. Anecdotally, 
our members are already being told by their auditors don’t expect 
much, if any, savings in audit fees from the proposals as they are 
presently written. 

While one would believe that private companies can bypass the 
Big Four and engage a second-tier accounting firm, this is frankly 
not a viable option. Investment banks that take these companies 
public or sell them require a Big Four audit as a sign of a clean 
bill of health. There is no competition. 

The SEC should allow and Congress should support the ability 
of accredited accounting professionals beyond the Big Four to per- 
form 404 attestations. By doing so we will create a healthy, com- 
petitive ecosystem where the market will set the right place for 
services rendered. 

Despite an urgent need for reform we will ask today that the 
SEC move forward cautiously while formalizing the proposed guid- 
ance. Blindly adopting recommendations without field testing them 
first would be akin to a venture capitalist purchasing a company 
without doing due diligence. Field testing ensures that, one, the 
recommendations will indeed reduce costs; two, all the players, in- 
cluding the accounting profession, are operating in the spirit of re- 
form; and three, that there are no unintended consequences. 

Field testing will also allow the SEC to make the adjustments as 
necessary without having to reopen a new process. Let’s prove that 
reform works before declaring victory. 

In conclusion, we are really at a critical inflection point. The good 
work of all involved will be for naught if the accounting profession 
does not get on board with cost reduction or if implementation of 
these proposals fail. Taking the time to field test and placing the 
needed pressure on the Big Four to join the effort is required. We 
have waited way too long for this reform to take place, but we are 
willing to wait longer to make sure reform is right. 

Thank you very much. 

ChairwomanVELAZQUEZ. Thank you, Mr. Heesen. 

[The prepared statement of Mr. Heesen may be found on page 99 
of the Appendix.] 

ChairwomanVELAZQUEZ. Our next witness is Mr. David 
Hirschmann. He is the Senior Vice President of the U.S. Chamber 
of Commerce and President of the U.S. Chamber Center for Capital 
Markets Competitiveness. Mr. Hirschmann is a member of the U.S. 
Chamber’s management committee and in this position helps shape 
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the strategic direction of the world’s largest business federation, 
representing more than 3 million businesses. Prior to joining the 
U.S. Chamber in 1992, Mr. Hirschmann worked as a legislative di- 
rector for former Congressman Toby Roth. You are welcome. 

STATEMENT OF DAVID HIRSCHMANN, PRESIDENT, U.S. CHAM- 
BER CENTER FOR CAPITAL MARKETS COMPETITIVENESS, 

U.S. CHAMBER OF COMMERCE 

Mr. Hirschmann. Thank you. Chairwoman Velazquez, for having 
me here today. Ranking Member Chabot, and members of the Com- 
mittee. I want to join the fellow panelists on this Committee in 
commending you for holding the hearing and I would like to make 
really four points: 

First, we welcome the changes that the SEC and the PCAOB 
have made to try to reflect in their rules what Congress intended. 
We view the PCAOB’s new auditing standard as well as the SEC’s 
guidance for management as significant steps forward. 

We do think Chairman Cox and the Commission and Chairman 
Olson and the Board should be commended for the leadership effort 
they are putting in and we believe they are trying to get it right. 
However, we will only know these efforts have been successful after 
we see how they are implemented by the auditors and companies 
and enforced by the PCAOB. 

Third, until we have a full year of experience, we agree with oth- 
ers who have called for a delay in implementing the new rules. We 
believe it would be a mistake to make small businesses the guinea 
pigs for the application of these new rules. 

It is important to remember that these rules are in place for fis- 
cal years that are currently running. In other words, they are going 
to apply to activities that have happened in companies already for 
5 months; and management and the accounting staff, which is very 
limited in small companies, are having to prepare already for an 
activity, even though they won’t file the reports the next year, it 
is for things that are currently happening. So in a way, small busi- 
nesses are already having to comply with rules that have not even 
been published. This is profoundly unfair and sets up a train wreck 
because, at the end of the day, the SEC won’t know why it failed, 
if it does fail, and we hope it doesn’t. They won’t know if it was 
because the calendar they put in place was unworkable or the new 
rules themselves have not achieved the job. We think this is an 
avoidable train wreck that can be handled by a further delay. 

Fourth, we urge Congress and the SEC to work together to ad- 
dress the additional critical issues that are making it harder and 
harder for leaders of smaller public companies to access the capital 
markets in order to grow their businesses and create jobs. The 
Chamber strongly supported many of the reforms in Sarbanes- 
Oxley, including more active and independent boards and board 
committees. Effective internal controls are an essential part of good 
financial governance for all companies. However, the implementa- 
tion of section 404 has led to costs and compliance burdens which 
are far beyond what Congress intended and well in excess of any 
benefits that can be accrued to shareholders and management. This 
is amplified among smaller public companies to the economies of 
scale. 
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Companies feel they are getting less effective advice from their 
auditors, and auditors are increasingly being second-guessed by 
their new regulator and the trial bar. The result is predictable. 
Companies increasingly find the cost of being a public company 
outweigh the benefits. 

For well over a century this has been the greatest country on 
Earth for entrepreneurs and innovators to access low-cost capital 
to start and expand a business. Transparent and liquid markets 
have been a key part of this. 

The flawed implementation of Sarbanes-Oxley section 404 has a 
disproportionate impact on the cost of capital for small businesses 
that have already had to comply. For example, a $1- to $2 million 
compliance price tag is an enormous burden for companies that 
have $3 million in net income. Literally, we have heard from com- 
panies that are forced to choose between providing health care to 
their employees, buying new equipment, investing in R&D, or com- 
plying with section 404. That is an impossible choice to put a grow- 
ing company through. 

As Chairman Cox has noted. Congress never intended for the 404 
process to become inflexible, burdensome and wasteful. The Cham- 
ber has consistently called for a series of changes to fix Sarbanes- 
Oxley 404, clarifying the terms such as material weakness, signifi- 
cant deficiency and materiality, ensuring that the rules are both 
risk-based and scalable, allowing for greater use of the work of oth- 
ers, providing specific guidance for IT systems and controls. We be- 
lieve the SEC and PCAOB have tried to address each of these 
areas and others; however, we remain concerned about the extent 
to which the new standards will improve on-the-ground implemen- 
tation. 

We also understand that SOX 404 has become somewhat of a 
catch-all term to refer to a broader set of issues facing public mar- 
kets and smaller public companies in particular. U.S. companies 
are facing changing retroactively applied accounting rules that are 
ever-increasing in complexity. As a result one in ten public compa- 
nies is forced to restate their earnings last year. This system is not 
working for companies, for investors and for auditors. 

America’s securities class action litigation system is broken. It 
provides an inadequate compensation to injured parties without de- 
terring future wrongdoers. It fails to protect small, undiversified in- 
vestors who seldom receive more than pennies on the dollar, while 
attorneys on both sides rake in millions of dollars in fees. The sys- 
tem is not working, and security regulators struggle to keep up 
with the speed of technology changes in today’s rapidly changing 
markets. The system is not working and our Nation is losing a key 
competitive advantage much. 

The challenge is clear and the voices are growing. We need to 
work together to ensure that U.S. capital markets remain the fair- 
est, most efficient, transparent and attractive in the world. 

Chairman Velazquez, Ranking Member Chabot, I thank you for 
the opportunity to discuss these issues and for paying such serious 
attention to such important issues as capital formation in our coun- 
try. 

ChairwomanVELAZQUEZ. Thank you, Mr. Hirschmann. 
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[The prepared statement of Mr. Hirschmann may be found on 
page 104 of the Appendix.] 

ChairwomanVELAZQUEZ. Now I recognize Ranking Member 
Chabot for the purpose of introducing his constituent. 

Mr.CHABOT. Thank you very much. I have the distinct honor to 
recognize our next witness who is actually from my congressional 
district in the city of Cincinnati. It is Richard G. Schmalzl who is 
with Graydon Head & Ritchey, which is one of the top law firms 
in our area. He got his law degree, J.D., from the University of Vir- 
ginia School of Law and LLM from Georgetown University Law 
Center. He is a partner with the firm, as I mentioned, of Graydon 
Head & Ritchey which is in Cincinnati, Ohio. Mr. Schmalzl serves 
as co-chair of the firm’s Business and Financial Client Service De- 
partment. His law practice has an emphasis on securities law, 
mergers and acquisitions, private equity, venture capital, corporate 
governance. Mr. Schmalzl’s recent publications include an article 
entitled "Sarbanes-Oxley: Coming Soon To Your Family Business." 
we welcome you here this afternoon, Mr. Schmalzl. 

STATEMENT OF RICHARD SCHMALZL, PARTNER, GRAYDON 
H EAD & RITCHEY LLP, CINCINNATI, OHIO 

Mr. Schmalzl. Good afternoon. Madam Chairwoman Velazquez, 
Ranking Member Chabot and members of the Committee. Thank 
you for inviting me to testify on the new 404 standards. 

My name is Dick Schmalzl and I have practiced securities laws 
for 25 years, primarily in Cincinnati, Ohio. I work closely with 
large and small public companies in a variety of industries. In re- 
cent years I have been on the front line with CEOs, CFOs and 
boards of directors in helping them become Sarbanes-Oxley compli- 
ant. I hope the Committee will find my real-world experiences help- 
ful to your consideration. 

The views I share with the Committee today are my own views 
and should not be attributed to my law firm, Graydon Head & 
Ritchey, or to any client of my law firm. 

I will address three primary topics: One, the most significant 
problems that 404 has caused for public companies, particularly 
small public companies; whether the new standards are likely to ef- 
fectively address those problems; and thirdly, to urge the Com- 
mittee to continue to evaluate the bigger picture of whether 404 is 
serving its intended purposes. 

My first topic is — I want to emphasize for you based on my first- 
hand experiences — the three most troubling real problems that 404 
has caused. 

First, as you well know, public companies are experiencing at 
least a doubling of out-of-pocket audit costs. We all know, and it 
has been well documented, these costs are disproportionately bur- 
densome to the smaller public companies. 

The second problem that sometimes doesn’t get as much atten- 
tion is substantial internal human resources must be devoted to 
404 compliance. This is especially problematic for smaller compa- 
nies who, even though they have highly qualified CFOs as control- 
lers, these persons must also play key roles in operating and grow- 
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ing their businesses. Compliance takes away from their ability to 
enhance shareholder value. 

The third problem is that 404 has been a major contributor to 
a deteriorating relationship between public companies and their 
independent outside auditors. If companies have to ask their audi- 
tors for advice on how to account for certain items, the simple act 
of asking the question has raised the risk that the company would 
be deemed to have a material weakness in their internal control 
even though the outside auditors often didn’t have definitive an- 
swers either. So companies stopped asking questions. They use 
their best judgment or hire a different audit firm for advice, even 
though that second firm doesn’t know their business as well as 
their main auditors. This is not healthy in light of increasingly 
complex accounting rules. 

These problems have also had more far-reaching consequences as 
some of my fellow panelists have noted. Public companies are in- 
creasingly looking at going private. For smaller public companies, 
their boards and officers would probably not be prudent fiduciaries 
if they didn’t at least examine the going-private alternative. 

Also, successful private companies and dynamic new ventures 
have virtually no aspiration to go public, regulatory burdens being 
the number one obstacle. When I talk to potential clients and exist- 
ing clients about going public, they dismiss that idea out of hand. 

Thirdly, even investment banking firms are looking for ways to 
avoid SEC registration for their clients by setting up unregistered 
stock trading systems. These developments are not healthy for 
small companies that want to grow by accessing the public capital 
markets or for U.S. markets in general. 

My second primary topic is whether the new standards will effec- 
tively alleviate these most troubling 404 problems. I want to com- 
mend the SEC and PCAOB on their extraordinary efforts in identi- 
fying and analyzing these problems. I believe, and my clients seem 
to agree, these new standards do an excellent job in theory to ad- 
dress the above problems. However, a high level of skepticism ex- 
ists as to whether the new standards will work in actual practice. 

Out-of-pocket audit costs are not expected to reduce significantly, 
by 10 to 15 percent at best. One of my small non-accelerated filers 
has already been told by its accounting firm that instead of having 
a 125 percent increase in audit fees, it may only be 100 percent; 
i.e., a doubling of their cost. Also, no substantial reduction at all 
is expected in the internal resources needed to comply with the 
new rules. And then, most importantly, significant concern exists 
whether the outside auditors will buy into the new standards. 

Without auditor buy-in, these standards can’t work. Company of- 
ficers realize that the auditors have all the power, and they have 
to do what the auditors want in order to obtain a clean 404 audit 
report. The SEC and PCAOB can only strongly emphasize to audi- 
tors the importance to buy in, but the regulators are probably lim- 
ited in their ability to do this. 

Also accountants likely and reasonably are concerned about their 
risk of liability, and perhaps some protection from liability would 
be warranted here as well. I think everyone who has spoken here 
today, except the SEC and PCAOB, have agreed that more time is 
needed for implementation. I certainly echo that feeling. With re- 
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spect to 404(a) and 404(b), management cannot put these controls 
in place without knowing their auditors are going to sign off. 

Lastly, I want to ask the committee to continue to evaluate the 
bigger picture of Section 404. Cost effectiveness is not the only 
problem. My conversations with officers and directors of public 
companies are uniform; they do not believe that 404 has signifi- 
cantly improved the quality of their financial reporting. Rather, 
they think it has created a lot of additional documentation, much 
of which is minutia. They also believe that they had good internal 
controls before 404 came into play and continue to do so. And per- 
haps most importantly, they are adamant that 404 will not prevent 
another Enron type fraud. 

In summary, I would like to say, the implementation of 404 has 
been a significant burden for public companies, particularly smaller 
ones. While the new standards provide some relief, 404 compliance 
is likely to be burdensome on public companies for years to come. 
Small public companies need more time to comply, if not a perma- 
nent exemption. And lastly, the jury should remain out and con- 
tinue to evaluate whether 404 works at all. I appreciate the oppor- 
tunity to have addressed these issues with you. I will welcome any 
questions that you might have. Thank you. 

[The prepared statement of Mr. Schmalzl may be found on page 
111 of the Appendix.] 

ChairwomanVELAZQUEZ. Thank you. 

Professor Scott, I would like to address my first question to you. 
You chair the Capital Markets Regulation Committee and you ex- 
amined the high cost of SOX 404 compliance and even rec- 
ommended that smaller public companies should not be directed to 
implement SOX 404 until compliance costs are contained. In fact, 
your committee recommended a thorough cost-benefit analysis of 
SOX 404 should be conducted before a small company would be di- 
rected to become SOX 404 compliant. 

In your estimation, how long will it take to conduct a thorough 
cost-benefit analysis of the new standard, and what sort of data 
should be collected? 

Mr.ScOTT. I am going to give you my guess on these questions 
because I have not really thoroughly considered them and talked 
to a lot of people. But I would say that this certainly could be done 
within a year. We would need a year of actual implementation of 
these standards to large companies, to all companies other than the 
small companies, so we could assess what the impact would be. As 
I said, during that period, what we should be doing is looking at 
the closest cohorts to the small companies, the $75 million to $100 
million companies, because that will give us a pretty good idea of 
what the impact is going to be on the smaller ones. Also, during 
this year of implementation to the large companies, which under 
the SEC’s proposal won’t fully be done until statements are filed 
in 2009. So I would say that we are really talking about doing this 
between 2007 today and during 2008. And I think, in addition to 
kind of getting information from the closest cohorts, they could 
interview in depth small companies. I sit on a board in which the 
auditors come forward, as does management, and tells us what it 
is going to cost. And I think we could have the SEC and PCAOB 
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interview these small companies and ask them directly, what are 
these standards going to cost you? What are the auditors going to 
charge? How would you estimate the time and effort management 
was going to spend? And as I said, Madam Chairwoman, the high- 
est percentage of these costs is for management. So it is really no 
answer to tell us that we are going to defer the auditing piece of 
this for small companies and implement the management piece let 
alone the problem that a number of us have referred to, that the 
management is left high and dry without any real comfort from the 
auditors because they are not going to have to be Section 404 com- 
pliant for another year. 

ChairwomanVELAZQUEZ. Thank you. 

Mr. Hirschmann, you heard me asking this question to Chairman 
Cox regarding the fact that under the existing time line smaller 
public companies will not have to issue SOX 404 compliance finan- 
cials until the spring of 2009. Corporate executives however will 
not sign a management report without an auditor’s attestation. 
Will you find small companies have to comply with both standards 
in advance of the December 2007 deadline? 

Mr. Hirschmann. I think the result is predictable here, unless we 
grant the delay. I think it is a very good question. I think what you 
will see is that companies will have two choices: Either they will 
go ahead and get their auditors involved, and because this is com- 
ing out late in the year, they will have to compete for attention of 
the auditors and may have trouble doing so because the audit firms 
are not fully staffed yet to provide that for smaller companies this 
year. So they will have a very difficult environment with a very 
high cost if they try to go that route. 

Or they can try to do it without their auditor. But if they do that, 
they risk that next year their auditor will come in and say, wait 
a minute, what you did last year was not adequate; we are finding 
material weaknesses here. And that is an invitation for lawsuits 
and litigation and impacting the price of stock and really setting 
back the entire company. So you are really putting small busi- 
nesses with two bad choices. 

ChairwomanVELAZQUEZ. Thank you. 

Mr. Greenwood, I know that your members, many of which are 
small research and development companies, are particularly con- 
cerned about the cost of complying with SOX 404. Since the new 
standard of scalable and principal-based, why aren’t they sufficient 
to address your members’ concerns about high compliance costs? 

Mr. Greenwood. Thank you. Fundamentally because, without 
the objective standard of using market capitalization and/or reve- 
nues, we think what will happen is that, given that the auditors 
have double incentives to maximize the compliance requirements — 
one, their fees; and, two, their liability — they want to err, their 
tendency is to err on the side of requiring more. So that is why we 
fear that our companies will not gain access to the scalability bene- 
fits of the changes. 

One of the things that is unique about our companies, I think 
unique entirely to the sector, is that a biotech company may begin 
with a molecule that its scientists think will cure some kind of can- 
cer. They then have years of research and years of development. 
Then they go into phase one clinical trials, phase two clinical trials. 
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phase three. They make an application before the FDA. They may 
have another year to wait. All of that might take 10 to 12 years 
or more and may cost hundreds of millions of dollars and yet they 
haven’t earned a penny in all of that time of revenue. And so, if 
you think about it, I had the honor to chair when I was chairman 
of the Oversight Investigation Subcommittee, to chair investiga- 
tions into companies like Enron and Global Crossing. And what 
would those scandals have been? They were largely about officers 
of companies who had stock options who wanted to exercise those 
stock options, who wanted the value of the stock to continue to in- 
flate, who falsely stated earnings and revenues in an attempt to 
meet the street’s requirements and keep the stock pumped up. 
That doesn’t apply to these companies. These companies have no 
revenues. They have no earnings. They only have investment. And 
when you take a company that needs to spend all of its money on 
research and development and then take significant segments, sec- 
tions of those invested dollars and use it for compliance that pro- 
vides really no value to the investor, it is truly overburdensome. 
The final thing I would say on that. Madam Chairman, is that 
what our companies tell us is that, when potential investors ask 
them about Sarbanes-Oxley compliance, it is not because they want 
to know how well protected they will be as investors. It is because 
they want to know how much money the company is wasting on 
SOX compliance. 

ChairwomanVELAZQUEZ. Thank you. 

Ms. Casey, you mentioned in your testimony about the manage- 
ment of some community banks indicating that they are seriously 
considering delisting. Can you talk to us, rather than incurring the 
cost of SOX 404 compliance, can you talk to us about what are the 
negative consequences to a community if their bank chooses to 
delist? 

Ms.Casey-Landry. Three years ago, we partnered with NASDAQ 
to create an index for community banks to provide more visibility 
in the capital markets for community banks and to facilitate their 
ability to raise capital. What we have found is, at the same time 
we did that, Sarbanes-Oxley came along. And so the cost of being 
a public company suddenly rose dramatically as the banks that 
were public were facing both the audit costs as well as the 404. Be- 
cause the index comprises some banks that are accelerated filers, 
they have already been in compliance positions. But as they began 
to look, the same statement that was just made by my colleague 
up here. Honorable Greenwood, about companies looking at what 
the investors were saying, they are not saying, what is the value 
of the 404 to improve the financial statements? They are saying, 
are you taking away that investment that can go back into the 
community, go back into the institution and will we be better off 
being a private company? And so the decision really hinges on 
whether or not the institution believes it can better serve their 
community and stay serving that community and not be forced to 
sell out. And some of them are making a decision to stay inde- 
pendent, to stay as a community bank, they would be better off 
being a private company, keeping those costs for the institutions 
and not spending it with their auditors. 

ChairwomanVELAZQUEZ. Thank you. 
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Mr. Heesen, I just will say that Section 404, Sarbanes-Oxley 404 
is the best protection that a venture capitalist like yourself and 
your members will have regarding corporate fraud. And yet I am 
impressed by how forceful you have been in advocating to delay 
this implementation of SOX 404. Can you explain? 

Mr. Heesen. Absolutely. I do not know of a single venture capi- 
talist who would say the advantages of Section 404 outweigh its 
disadvantages. And that is as an investor talking. A venture capi- 
talist wears two hats. He is an investor as well as he sits on a 
board. But I do not know literally of a single venture capitalist who 
would say the benefits outweigh the problems that have been asso- 
ciated with 404. It is a drain on the resources of the company. It 
is unquestionable. The money needs to go one place in a merging 
growth company, and that is into R&D. You want to grow that 
company and make it as competitive as possible as quickly as you 
can. If you have money being diverted to Sarbanes-Oxley’s cause, 
that is money being diverted from R&D. Basically that is a com- 
petitiveness issue, very simply. But it also demonstrates that our 
companies today take longer than they ever have to go public. And 
most importantly, more and more of our CEOs are saying it is not 
worth going public; I would rather get acquired. Now you are still 
going to have to be Sarbanes-Oxley compliant to be acquired, but 
they are just saying it is not worth it to basically be in charge of 
a company that I am basically a babysitter for regulation instead 
of a company builder. And so they are selling out. And that is not 
good for the econorny at the end of the day. 

ChairwomanVELAZQUEZ. Thank you. 

Mr. Chabot. 

Mr.CHABOT. Thank you very much. Madam Chair. 

Mr. Schmalzl, I’ll start with you if to I can. You have mentioned 
before that many of the companies that you are dealing with are 
very hesitant, if not I think it is maybe laughable to go public 
when one considers the additional burdens that are imposed. 
Would you kind of discuss maybe philosophically or with the econ- 
omy in mind, what does it really matter whether companies stay 
private or whether they go public? What does that mean in the 
overall scheme of things? We are a capitalist society obviously and 
want people to be participatory in business and that whole thing. 
Could you talk about that a little bit? 

Mr. Schmalzl. Sure. I have always viewed the main reason for 
a company to go public is that they want to be able to grow their 
company. And being able to access the public capital markets has 
been the most effective way of getting capital to grow your com- 
pany. Also that provides advantages for the investing public as 
companies. You know, numerous — Microsoft, Google. As the indi- 
vidual investors and institutional investors can share in that 
growth, I think that is good for everyone. With the public markets 
effectively being closed to these growing companies who otherwise 
might be considering it, I think we are cutting off a lot of opportu- 
nities for those businesses, for the employees who work in those 
businesses because their growth is stunted. And I agree with Mr. 
Heesen on the inability for — ^you know, if these companies end up 
being acquired by larger companies, the adverse effect on their in- 
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novation isn’t the same. I think we need to grow our own. And if 
going public isn’t a viable option for these companies I think we 
feel the effects of that in a variety of ways across our economy. 

Mr.CHABOT. Thank you. And Professor Scott, I noticed you nod- 
ding. I don’t know if it was the question or the answer. But I would 
be happy to maybe throw you that softball, too, and ask you to 
comment upon it. And maybe also keeping in mind what Mr. 
Schmalzl also mentioned: It is not just the investors; it is also folks 
that maybe would never fathom investing but ultimately are going 
to need a place to work and support their families and that sort 
of thing. 

Mr. Scott. Right. Another aspect of this problem which the com- 
mittee thought was quite important was the fact that venture cap- 
italists, in order to create incentives for them to invest, want to 
have a public exit. This has been the dream. The venture capital- 
ists come along, they invest. They nurture the company, and the 
company goes public, and over a period of time, the venture capital- 
ists cash out and make money. 

Now, if that result is limited because of the unattractiveness of 
the public markets, what we are going to see is less investment on 
the front end by venture capitalists and small companies because 
this investment is going to be less attractive to them because they 
can’t cash out in the public markets because of some of the costs 
that we have been talking about. And this is fundamental. This in- 
vestment fuels this economy. Anything we do to interfere with it 
is a very serious matter. 

Mr.CHABOT. And is it accurate to say that we are trying to main- 
tain some balance, because obviously if people are buying stocks in 
companies or they have their pensions invested in that company 
and people are crooked or doing things that they shouldn’t be 
doing, we want to protect them, but at the same time not kill the 
goose that created this wonderful economy or America that we 
enjoy. 

Mr.ScoTT. Right. I totally agree with that. We are not just fo- 
cused on the cost, we are focused on the cost-benefit relationship. 
So the issue here is whether the benefits from 404 exceed the costs. 
And those benefits that we are talking about are to investors. That 
is why it is incumbent on the SEC to do a very thorough empirical 
analysis of this issue before we implement. 

Mr.CHABOT. Jim, let me start with you on this one if I can, and 
we will just go down, anybody that would like to comment. I’ll 
make this my last question so we can get to some other members. 
I believe you were all here, correct me if I’m wrong about this, 
when both Chairman Cox and Chairman Olson testified. Everybody 
was here I think during that. Could you tell me what are one or 
more, depending on how you want to take this, things that were 
said that you disagree with or that you take issue with or that con- 
cern you about what you heard when it comes to business and how 
404 and all this affects businesses in our communities around the 
country. 

Mr. Greenwood. I think. Ranking Member, that the point that I 
thought is most important in this entire hearing is really about the 
loss of the quantitative threshold for smallness. Mr. Olson’s testi- 
mony was that they originally thought that was a good idea and 
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then, in reevaluating, it seemed not flexible enough. And I would 
agree with him if the issue is, well, there are companies that might 
exceed a $75 million revenue threshold that are also very simple. 
And if that is the case and if the PCAOB said maybe we want to 
give auditors the opportunity to look at a company with $80 million 
or $100 million in revenue that has very simple financials and also 
incorporate them into this more scalable methodology. That is not 
what they did. 

What they did is they did away with the quantitative threshold 
all together. And we think, without that, as I mentioned earlier, we 
think without that auditors will opt for a more complex review and 
that it will be of extreme cost to the companies really debilitating 
their abilities to do their research and development and providing 
little if any additional protection for investors. 

Mr.CHABOT. Thank you. 

Ms. Casey-Landry. 

Ms.Casey-Landry. Thank you. Ranking Member Chabot. I think 
the comment that struck me the most was during the questioning 
with the chairwoman regarding implementation of 404(a) and 
404(b). The reality is that we are already in the fiscal year for com- 
munity banks and for any company. And the guidance isn’t final- 
ized. It still has to go through the 0MB process, and then it needs 
to be out there. And I think the biggest challenge that Chairman 
Olson and Chairman Cox need to recognize is, once this is ap- 
proved, that giving speeches and passing out pamphlets is not 
going to be enough to educate the profession with respect to how 
to handle 404 compliance for smaller companies, and at the same 
time, these smaller companies will have to begin to undertake the 
management review of their internal controls. And like everybody 
else said, banks are regulated by other entities, and they are not 
going to sign off on an internal controls report for their bank regu- 
lators much less for their auditors without these things being right. 
So I think the 1 year extension is absolutely critical. 

Mr.CHABOT. Thank you. 

Professor Scott. 

Mr. Scott. Three points. First of all, adopting 404 for small com- 
panies without a thorough cost-benefit analysis in advance of the 
adoption. Second, bifurcating the implementation of the manage- 
ment and auditor standards in two different years. And third, not 
adopting a quantitative standard for materiality in the guidance. 

Mr.CHABOT. Thank you very much. 

Mr. Heesen. 

Mr.HEESEN. I was, frankly, very surprised at the total lack of 
recognition that this regulation rule actually has to be imple- 
mented and that accountants are going to implement this and that 
you can have anything you want on paper. But if the accounting 
community doesn’t actually want to implement this, they are not 
going to implement it. And I think that is an issue that is not being 
addressed at all. I think that as it stands right now, the big four 
are holding a lot of cards here. And if they don’t want to see these 
changes implemented, they are going to have the power not to im- 
plement them. And no one that I heard from either the SEC or the 
PCAOB are talking about what I view as a very basic issue here, 
and that is implementation of these things. 
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Mr.CHABOT. Thank you. 

Mr. Hirschmann. 

Mr.HiRSCHMANN. I have three quick points. First is, I was sur- 
prised to hear Chairman Cox say that he feels like he is close to 
the finish line. I really think this is an important step, but we are 
not yet at the finish line. And the implementation is important. I 
would hope that the SEC and the PCAOB would open to make ad- 
ditional changes if needed. Second, with regard to the PCAOB and 
the inspections process, until auditors feel that they will not be sec- 
ond guessed, if they simply don’t repeat what they have already 
been doing, I don’t think you can expect auditors facing huge liabil- 
ity to change the way they approach. So a change to the inspec- 
tions process at the PCAOB is very important. And third is the 
cost-benefit issue. And I would just point out, there are a lot of 
good people working at the SEC. It is a good agency. But the abil- 
ity to conduct a cost-benefit analysis is a material weakness at the 
SEC. They simply cannot do it consistently well. It is been the sub- 
ject of litigation which they have consistently lost and this is just 
another proof that they don’t have the ability to do it. 

Mr.CHABOT. Thank you. Finally Mr. Schmalzl. 

Mr.ScHMALZL. Yes. I would echo all the same points. First, I was 
a little dismayed that it seemed to me that Chairman Cox really 
didn’t understand in practice what it takes to comply with 404(a). 
The internal resources needed that management needs to devote to 
that process is significant regardless of whether or not you add the 
out-of-pocket audit cost to that. 

Second, I didn’t think there was enough credence given to how 
much power the auditors have in this process. Unless the SEC and 
PCAOB can get some confidence that the auditors are going to buy 
into these standards, I think the people I talk with at public com- 
panies really think that the process is futile unless the auditors 
buy in. 

And then, thirdly, I believe the SEC pretty much assumes at this 
point that 404 is working and that it prevents fraud and that it is 
creating investor confidence. My clients clearly do not believe that. 
Their feeling is that the market really doesn’t care about these re- 
ports and that, as others have said, what they care about is, how 
much is it costing you to obtain that report? So I think that, to the 
extent that the SEC or PCAOB have essentially declared victory on 
the 404 point, I think that is mistaken. 

Mr.CHABOT. Thank you very much. I want to thank the entire 
panel for their answers. I yield back. 

ChairwomanVELAZQUEZ. Mr. Ellsworth. 

Mr. Ellsworth. Thank you. Madam Chairwoman. 

Thank you all for coming. It is very informative, for you holding 
the hearing and for you all testifying. I found it fascinating. I 
guess, first, a couple of observations. One, we keep talking about 
an extension. And I come to find that if people just give me bad 
news and tell me, if they come up and tell me, hey, I am going to 
punch you in the nose right now or punch you in 5 minutes, I still 
bleed and my nose still hurts 5 minutes later. And so just an exten- 
sion doesn’t sound like a fix. Is it fair to say that no one on this 
panel believes that we can achieve the intended goal of 404 the 
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way it is written right now? I think I am safe in assuming that we 
are not achieving the goal. And I see some heads shaking. If you 
can give me that nod I’ll take that as the affirmative. 

So those two observations being said, I don’t know, Professor, 
maybe you are the first one or Mr. Hirschmann, I don’t know; what 
is the fix? If I gave you the magic wand or the magic pen, you 
know what we want to do, or what was intended here? What is the 
best way? Do we make it go away totally, wave the wand and make 
it go away, or what is the bullet point fix on this? 

Mr. Scott. Well, I think there should be a two-stage fix. The first 
stage is that we should adopt reforms, part of which have been 
done, but more that need to be done, particularly a quantitative 
materiality standard. And then field test this in terms of the cost 
and benefits to small companies. Now, if the costs still outweigh 
the benefits, which they may well be, then I think the Congress 
has to address this. What our committee said is, in that event, 
what the Congress should do is to exempt small companies from 
the auditor attestation requirement. At the same time, however, 
because management would not have the comfort of this outside 
auditor opinion, that the certification standard that management 
now has, which is pretty high, be lowered in terms of what man- 
agement would really have to say about their confidence in the in- 
ternal controls. 

But before we ever get there. Congressman, I think the first step 
is, let’s do whatever we can to make this a more efficient system. 
And I think there are steps yet to be taken. And when we do that, 
let’s figure out what the cost benefit is, a thorough study, for small 
companies. And only if that doesn’t work should the Congress come 
back into the picture. 

Ms.Casey-Landry. May I just point out that the bill that was in- 
troduced by Representatives Greg Meeks and Tom Feeney would 
provide an exemption for smaller companies. And I think that 
would be something that would be worthy of Congress considering. 
But that is a broader question and some other committees get in- 
volved in that. 

Mr. Hirschmann. I do think they are trying to fix the problem. 
And part of the challenge is they don’t have the tools in their 
hands to completely solve the problem. They can certainly fix the 
implementation of 404. What they cannot do is address the rest of 
the equation which is the complexity of our accounting standards, 
the fact that accounting rules are increasingly complex, interpreted 
retroactively, they are forcing one in ten public companies with an 
escalating number every year to restate their earnings. The whole 
litigation environment around auditors, there is a bigger picture 
here that goes beyond 404. And I don’t think until you address all 
those pieces you can really ultimately solve this for anybody. 

Mr. Greenwood. I would reiterate that the real fix is probably to 
go back and provide a complete exemption for the smaller compa- 
nies. And I would base that on revenue, not on market capitaliza- 
tion because market capitalization can, A fluctuate wildly. A 
biotech company may have a drug. And based on the promise of 
that drug, its stock value may be here. And in clinical trials, it 
doesn’t prove out to do what the company hoped it would. So the 
market cap drops precipitously. There are still no revenues coming 
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into the company. So I would use a revenue test for exemptions. 
And Congress should certainly seriously consider doing that. And 
I don’t think that it would he, as somebody who has spent 24 years 
in public office, I don’t think there would be a public reaction that 
would be negative. I think people instinctively understand that 
small companies are not the Enrons and the Global Crossings and 
the WorldComs. 

Mr.ScHMALZL. I would like to add to that I would agree that a 
broader exemption for small public companies defined in a different 
way would be a big advantage. And I think there should be a net 
revenue and/or gross revenue test attached to that. Also I would 
like to say that I am not at all negative on Sarbanes-Oxley. I think 
Sarbanes-Oxley has done an awful lot of good things for public 
companies. Boards of directors are more effective. Audit committees 
are much more effective. There is more information into the factor 
faster. Those are all very good positives about Sarbanes-Oxley. And 
I think we achieve all of those without 404 and without the incred- 
ible costs associated with 404. So I wouldn’t rule out the possibility 
of appealing it for everybody. But if we are not going to do that I 
would certainly try to exempt out a larger batch of those smaller 
companies, particularly ones that are still struggling to get to a 
revenue level that really can support these kind of costs. 

Mr.HEESEN. I just look at it from the angle that the SEC, Small 
Business Committee that looked at this issue came up with these 
kinds of proposals. They were rejected basically by two very strong 
votes, and that was the accounting firms. And so I think, once 
again, you have to look at this and say, what at the end of the day 
will the accounting industry feel comfortable with that businesses 
also can feel comfortable with? And that is a hard balance. But 
even from our companies, companies that are going to be acquired 
today, I don’t care how big or how small they are, they are going 
to have to be Sarbanes-Oxley compliant. A bigger company is not 
going to acquire a smaller company unless all the Is are dotted and 
all the Ts are crossed. It is just too much liability coming in. And 
so this goes beyond simply trying to say, let’s exempt X amount of 
companies and it will solve everything, because frankly it won’t. 

Mr. Ellsworth. Thank you all very much. I yield any time I 
might have. 

ChairwomanVELAZQUEZ. Thank you. 

Jim, you spoke about the cost for your members in terms of Sec- 
tion 404. My question to you is, does your organization plan to col- 
lect data that quantifies compliance costs for new members before 
and after the new standards are in place. And if you are going to 
do that, would you be willing to share that data with us. 

Mr.GREENWOOD. Absolutely we would be willing to do that. We 
have lots of anecdotal data, some of which we have shared with 
your staff. Madam Chairwoman. But we would certainly be looking 
forward to working with your committee on compiling data with 
our members that would be helpful in your decision making. 

ChairwomanVELAZQUEZ. Thank you. 

Mr. Heesen, several studies have cited evidence that the U.S. 
stock markets are becoming less competitive, and some have sug- 
gested that expensive regulation, including Section 404, may be 
partly to blame. In fact the mayor of New York, Mr. Bloomberg, re- 
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leased one of those studies. Can you comment on the relationship, 
if any, that you see between SOX 404 compliance and the apparent 
increase in the number of firms deciding to list their shares on full 
markets. 

Mr.HEESEN. I think part of it is Sarbanes-Oxley. I think it is un- 
fair to blame Sarbanes-Oxley for everything. I think we are living 
in a much more global economy today. There are many foreign ex- 
changers that are much better today than they were 5 years ago. 
Having said that, I think many of them have gotten better because 
of Sarbanes-Oxley. I think they have gotten much more aggressive 
in coming into the U.S. and marketing to our companies and saying 
please let’s go public on AIM or on Tokyo or somewhere else. You 
are also seeing companies that venture capitalists have backed that 
may be based in another country that in the past would have gone 
public on NASDAQ and instead today are going public on the Bom- 
bay exchange or on the Tokyo exchange. Now, part of that is be- 
cause they are in their home country. But the other part of that 
is because those exchanges have gotten better and smarter and 
much more aggressive than NASDAQ has because of Sarbanes- 
Oxley. So some of it actually is very much a part of Sarbanes- 
Oxley. Some of it is part of just globalization in general. 

ChairwomanVELAZQUEZ. Definitely. And I did not intend to say 
that it is just only to blame for Section 404, but is the cost of regu- 
lations, including Section 404. Professor Scott, do you mind to com- 
ment? 

Mr. Scott. Yes. Of course, this was a major finding of our com- 
mittee’s report that a number of factors were leading our public 
markets to be less competitive. In addition to regulation in general, 
which you have observed 404 is part of, we have two other con- 
cerns. First of all, the cost of litigation here, which is very high on 
the list of why foreign companies do not want to come to the 
United States. And secondly, in view of our committee, a deficit in 
the rights of shareholders in the United States compared to our 
countries. For example, other countries permit their shareholders 
to vote on the adoption of poisoned pills which are an impediment 
to takeovers. Our public company’s shareholders don’t have those 
rights. We have a possibility of having plurality voting rather than 
majority voting. So I would say in addition to regulations the cost 
of litigation and the deficit in shareholder rights. That was the con- 
clusion. And as Mark observed, foreign markets are becoming more 
competitive. The point is, we can’t just do what we want to do any- 
more. This is a competitive world, and we have to accept that re- 
ality. 

ChairwomanVELAZQUEZ. Yes. 

Ms.Casey-Landry. I just wanted to make one comment. Commu- 
nity banks don’t have the option to go to another exchange. And 
if they want to stay public and they want to have access to file cap- 
ital markets then we need to have a system that is fair so that they 
can go to NASDAQ, they are going to go to the New York Stock 
Exchange, and they be listed and that they can be competitive. 
When we place undue burdens on smaller companies that can’t go 
global then we are really affecting our own base and own economy. 
And I would just point out that 404 has been a problem. And at 
the same time you do have community banks. We just added an- 
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other 50 banks to our index in the past 6 months. But, I mean, 
banks that chose to go public. So there are companies that are still 
going public at the same time those are choosing to delist. But it 
is important to keep it domestically focused, too. 

ChairwomanVELAZQUEZ. Thank you. 

Any other witness? Yes, Mr. Hirschmann. 

Mr.HiRSCHMANN. I want to just agree with the point that there 
is a lot of good in Sarbanes-Oxley. But the 168 words of Section 404 
we refer to as the 168 words that stole the act. So I hope that not 
the final words. And I commend the committee for holding this 
hearing and look forward to working with you to make the changes 
that are needed. 

ChairwomanVELAZQUEZ. Thank you. Mr. Chabot. 

Mr.CHABOT. Thank you. Madam Chair. 

I just want to once again commend you for holding this hearing 
and thank you for doing so and thank the panel here. I thought 
they gave us some very insightful information. And I want to espe- 
cially thank Mr. Schmalzl for coming all the way from my district 
back in Cincinnati, but I thought everybody here was really very 
good and we appreciate you holding this hearing. 

ChairwomanVELAZQUEZ. I echo the remarks made by the Rank- 
ing Member. It has been a great hearing, and I believe that, yes, 
there is so much good on Sarbanes-Oxley, but we have to make 
sure that we get it right. And I don’t see the rush in terms of com- 
pliance right away without knowing and having the empirical data 
that shows that there is the cost-benefit analysis that will help the 
small companies to continue to grow and do what you do best in 
this country and our economy, and that is the research, the devel- 
opment, but at the end, job creation, and that is very important. 
So with that, I want to thank all of the witnesses. And members 
wishing to submit statements or documents into the hearing record 
will have five legislative days to do so. This hearing is now ad- 
journed. Thank you. 

[Whereupon, at 4:45 p.m., the committee was adjourned.] 
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STATEMENT 
of the 

Honorable Nydia M. Velazquez, Chair 
Committee on Small Business 

Full Committee Hearing on the Implementation of Section 404 of Sarbanes Oxley Act 
Tuesday, June 5, 2007 


I call this hearing to order. This afternoon the Committee will examine the implementation of 
Section 404 of the Sarbanes Oxley Act and consider whether the new standards that the SEC 
and PCAOB approved last month will lower compliance costs for smaller companies. 

Small firms continue to be supportive of the intent of the Sarbanes-Oxley Act and many have 
benefited from the stronger corporate governance culture that it encouraged. However, what 
we have continued to hear is that these benefits - and particularly those associated with 
Section 404 - come at a very steep cost. This continues to make me believe that these new 
regulations should be delayed. 

This additional time is especially important for smaller companies, which often operate with 
limited human and financial resources - and are disproportionately burdened by these high 
costs. We may jeopardize some of our country’s most innovative endeavors if we fail to 
adequately balance investor protection with the associated regulatory burden. 

Last month, new management guidance and an auditing standard for Section 404 were 
approved. The result of nearly 2 years of work, these new standards seek to make Sarbanes- 
Oxley compliance more efficient and cost effective for companies of all sizes. While I am 
encouraged by this, I am concerned about the proposed timeline under which small firms 
would have to comply with the new regulations. 

Earlier this year. Ranking Member Chabot and I wrote to Chairmen Cox and Olson and 
expressed our concern that the proposed implementation timeline was inadequate to assess its 
effectiveness. Postponing the December 2007 and December 2008 deadlines by at least one 
year would allow for the new standards to be tested and for evidence to be collected that could 
confirm that the new standards do, in fact, lower costs for small firms. 

Small businesses are significant sources of research and development. Job creation, and 
innovation in our economy. It is critical that the SEC and PCAOB work to ensure that SOX 
404 is implemented in a way that contributes to increased investor confidence - but that also 
does not hamper America’s competitiveness. Postponing the compliance deadlines for at least 
an additional year would allow us to make this determination. 
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A delay would also provide for the training for small companies and also for auditing firms. 
It would also permit the PCAOB’s efficiency inspectors to assess whether audit firms are 
implementing the new standards in the manner intended. At a minimum, these steps would 
help ensure a more effective implementation of these new standards - and recognize the 
unique situation that many companies find themselves in. 

These new standards come at a time when small businesses are already spending 45 percent 
more than larger firms on regulatory compliance. To ensure that these burdens become more 
manageable, we should not be piling new regulations on until they have been thoroughly 
reviewed. Today’s hearing will help us accomplish this - and by doing so - it will 
demonstrate that a delay is necessary to better balance the costs and benefits of these new 
standards. 

I now recognize Mr. Chabot for his opening statement. 
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Sarbanes-Oxley Section 404: Will the SEC and PCAOB's New 
Standards Lower Compliance Costs for Small Companies? 

Committee Full Committee 

Date 6/5/2007 


Opening Statement of Ranking Member Chabot 

I h ink N'.iJ.ini t n.iii svom<in. and ihank you tor holding tbis heating on Section 404 ot oii. 
s.i’Kiiics-OxleyActand its impact on'smaU business. 

The Sarbane!>43xley Act has Ilvo 1 . 1 . .aj- bcj as the mosi inipurtant and tar reaching securiii» 
legislation since the Securities Act of 1933 and the Securities Exchange Act of 1934. svhitdi were 
nassed following the sipek market crash of 1929 Signed into law in 200i2 in response to the 
Bankruptcy oi Enron Corporation, the WoAdCam scandal, and other coiporais failures the 
Sarbanes-Oxley ActestaUbhcdiliLlhiblK.l'umpdnvAci.iiontiTutKetsinhlDri'u'.KPi Vili' a 
pn ii ■ M itnr nnniiiolTl cn-aniiailicii That t-versees public cotnpam auditors a. d uiacts ai. ! ■• .. 
stapiliri' iteAcialsorestnC-aceouiiiin, fHtns&ompaibmuiigaiiuinbu'otothi.rseisii.c 'r 
con 1 ' nils wh’ch tKv au''il and rcquirts new diaclosures f'r pi blic cn’p mu*- nd tliiir uliii-r 

\T hile the Aci has generally brrn viewed as neievsory 10 restore public sad mvistnr lont d iiii in 
our capital markets and improvi th TCinbihlv and tnuHpatGir..v 01 lorporite finun. .11 r o r 
concerns have been raised about the burden and cost of compliance for small and inediiim-sired 
companies One of the most coottoVeisia’ im visions !ici>ui.il 41M Miuiagemeiit .T c.imen'oi 
Internal Controls, requires management and auditors uiasse^intennahconlrols over financial 
reporting, and requires extecnal auditors to report on nranagmneiit'sassessineiil and certify the to the 
effectiveness of miemal controls 

According to an April 2006 Tjuveimneut Acmunlabiluy OiTice studv, small busmesses expend a 
disproportionately greater amount oi iiiiienrii niuiiiv r is iipcicenlagtiiol revmue'Ui npl'inv nth 
Sarhanes-Oxlev than larur | ubiic lui '"'■i us f trms with ^ I bilbon o, mon; spend uiireeii c 1 1,1 
$ 1 00 m revenue for audit fees to comply with SaibatMS<Oxl^ nenlBtioits, wh'fe small businesses 
spend more than SI 

It .iiLinlls -i.>ree4ihd|thibBncs.4>\Jeylias]iadapr'si>vei<tec*.ii iiivi-iti (rutcclion aid 
cuiifidenve Rut ns burden on small business has not onfv affected their bottom line, but also their 
. ompetitivcness m our global economy GAO found that small businesses used resources toi 
Sarbanes-Oxley compliance rather than for otlivt busmess activities. A recent Kauftman-RAND 
Center for the Study of Small Business and Regulation said that Saibanes-Usley vaused small firms 
’o exit the public capital maihet. 

L 1 st y ear, the Securities and Exchange L'ommissioa (SEC) aiinuunued th.ii it would delay ihi 
.ipphcation of Secilon 404 to the smallest compames until later in 2007 Unher this yeai . the 
Cliairwoman and I urged the SEC to delay umilciiientatioit of the new Intel lul conuoLv standaios lo 
allow small businesses additional tune to comply On May 23, 20U7. the SCI. jiiiiuuiieed ,t would 
mil allow such an extension 

\i iis \lay 23, 2007 meeting, the SEC adopted rules designed to reduce lost- roi i ,iiiiphj,ici' wiih 
Section 404 for alt businesses. In addition, the Commission adopted proposed roles cxaminiiii: ihi 
. ^iioml disclosure requirements for small companies wanting to gn publii I his lepieseiiix .in 
excellent opportunity for the Commission to examine the cumulative impact of its ruius bn small 
companies and reduce those while still sti mg to maintain investor eunildcnee 
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M;iil.im Cliairwdinan, I conii;ierd you for holding this hearing on Soel.on J(i t I w.inl lo 

note iliat in LidJiiii'n lo oiir fianei of experts, we have with us .in altomoi fioni (.iiitiiiiiaii who h.is 
re.il world lACtrieiiL'e in helping small public company clients to deal with, the eli.illenges (>fSceiio.i 
lUl complioiiee. I look forwaid to hearing from each of our witnesses. 
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TESTIMONY OF CHRISTOPHER COX 
CHAIRMAN, U.S. SECURITIES AND EXCHANGE COMMISSION 

AT HEARING ENTITLED 

'WILL THE SEC’S AND PCAOB’S NEW STANDARDS 
LOWER COMPLIANCE COSTS FOR SMALL COMPANIES?’ 

BEFORE THE 

COMMITTEE ON SMALL BUSINESS 
U.S. HOUSE OF REPRESENTATIVES 

June 5, 2007 

Chairwoman Velazquez, Ranking Member Chabot, and Members of the Committee: 

Thank you for inviting me to testify on behalf of the Securities and Exchange 
Commission concerning the application of section 404 of the Sarbanes-Oxley Act to 
small businesses. 

This Committee’s charge is a vitally important one, both to the millions of small 
businesses in America, and to our economy. For our part, the SEC is charged by statute 
with the protection of investors, fostering efficient markets, and the promotion of capital 
formation. Small business needs all of these to survive. Like every Member of this 
Committee, we are completely committed to fostering a climate of entrepreneurship that 
helps promote small business growth, and the creation of the many jobs and goods and 
services in our country that are produced by small business. 

For a small business, raising private capital often depends upon the future viability of 
tapping the public markets. It isn’t just the company that is ready to go public today that 
benefits from a healthy market in publicly traded securities. Every startup, every new 
business idea - every determined woman with a dream, and every man striking out on his 
own - needs a flourishing IPO market. 

America creates far more new businesses than does Europe. And our capital markets 
have a far higher percentage of individual owners of securities. So it’s essential for the 
vitality of our economy that we protect both the opportunity for small businesses to raise 
the capital they need to innovate and the savings of individual investors that are invested 
in the securities of public companies. 

Today, nearly five years after the Sarbanes-Oxley Act was signed into law, over 6,000 
public companies still aren’t required to provide the audited internal control disclosures 
required by section 404. Generally, every public company with securities registered with 
the Commission, if it has less than $75 million in public equity, falls into this category. 
They haven't been required to comply with section 404 because the Commission has been 
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very sensitive to the special concerns of smaller public companies. All other public 
companies in the United States already have three years of reporting on internal controls 
behind them. 

The Commission has delayed section 404 compliance for smaller companies because of 
the disproportionately higher costs they face compared to larger companies. Our 
experience of the first three years told us that the way 404 was being implemented was 
too expensive for everyone - and imposing that system on the smallest companies would 
impose unacceptably high costs from the standpoint of the companies’ investors, who 
would have to pay the bills. 

So the Commission and the Public Company Accounting Oversight Board set out to 
address the unique concerns of small business. We further delayed the implementation of 
404 for smaller public companies imtil Chairman Olson and I, working together with the 
full Commission and the PCAOB, could replace the current inefficient system of 404 
implementation with a more streamlined approach. 

Our intention all along has been to re-focus 404 compliance on the specific problem that 
Congress had in mind: material risks to the financial reporting system. In that way, we 
will better protect investors and companies will more wisely spend their money on more 
meaningful internal control audits. And I am pleased to report to you today that the 
Commission and the PCAOB have voted to completely replace the inefficient system you 
have heard so much about with new guidance for management and a completely new 
standard for auditors. 

In a moment. Chairman Olson will talk about the particulars of the PCAOB ’s new 
auditing standard, Auditing Standard No. 5 (AS 5), which, if approved by the SEC, will 
replace Auditing Standard No. 2 (AS 2). But I can tell you that the SEC and the PCAOB 
worked closely together on the development of this new standard to eliminate any 
language that would create an expectation that a small business's controls would have to 
be designed to fit the audit, rather than the audit being designed to fit the controls. AS 5, 
and the Commission’s recent revisions to certain rules in Regulation S-X, also make clear 
that auditors are not opining on the methods or on the procedures that a small business 
uses to evaluate its internal controls. Rather, they are opining on the effectiveness of the 
internal control structure and procedures. 

The replacement of AS 2 with a completely new auditing standard is vitally important to 
small business, because the prospect of being required to undergo the same kind of 
expensive internal control audit that large companies faced under AS 2 was the part of 
the 404 process about which smaller companies had complained of the most. 

The SEC and the PCAOB also worked together on something brand new, that small 
business and companies of all sizes have never had before: specific guidance for 
management about its role in assessing internal controls, as distinct from the role of the 
auditor. This kind of guidance simply did not exist before. Rather, companies were 
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forced to rely on standards for auditors, not companies, and those standards were 
themselves heavily criticized for being overly complex. 

As a result, we now have SEC guidance expressly intended for management that is 
already finalized. And in a matter of months, I expect that the nation will also have a 
new SEC-approved auditing standard for auditors to use in their implementation of SOX 
404. 

The focus of this hearing is on whether the SEC's new guidance for management, and the 
PCAOB's new standard for auditors, will lower compliance costs for small companies. 
The answer is yes. 

We expect the unduly high costs of implementing section 404 of the Act under the 
previous auditing standard will come down. They should come down because now, a 
company will be able to focus on the areas that present the greatest risk of material 
misstatements in the financials. This is what the law has always intended we be focused 
on. It's also what investors care about. It's what’s important for achieving reliable 
financial reporting. 

Compliance costs should come down because the new SEC guidance that's been 
developed specifically for management will allow each small business to exercise 
significant judgment in designing an evaluation that is tailored to its individual 
circumstances. Unlike external auditors, management in a smaller company tends to 
work with its internal controls on a daily basis. They have a great deal of knowledge 
about how their firm operates. Our new guidance allows management to make use of that 
knowledge, which should lead to a much more efficient assessment process. 

Compliance costs should also come down for the minority of smaller public companies 
that had already complied with section 404 under the old auditing standard. In 
recognition of the fact that many of those companies have already invested considerable 
resources in the design and implementation of their processes, the Commission’s 
guidance does not disrupt or require any changes to what they are now doing. While 
these smaller companies should benefit from the top-down, risk-based, materiality- 
focused, and scalable nature of both the SEC's new guidance and the PCAOB's new 
auditing standard, they should not have to expend new resources to do so. 

The Commission has also made clear that our new guidance for management provides 
one way, but not the only way, to comply with the 404 requirement for an annual 
assessment of internal controls. We've made it clear that management can follow other 
reasonable approaches, too. For those managements that do follow the basic approach 
described in our guidance, we’ve adopted a rule that gives them the comfort of knowing 
that by doing so they have satisfied their obligation to evaluate their internal controls. 

It is our intention that the SEC's new 404 guidance for management and the PCAOB's 
new AS 5 will work together to clearly delineate the company's responsibility for the 
methods and procedures it uses in its internal controls evaluation process, on the one 
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hand, and the auditor’s responsibility for opining on management's assessment, on the 
other hand. In combination, the Commission’s guidance and the PCAOB's new auditing 
standard should result in management using a top-down, risked-based approach to its 
evaluation of internal controls. And they should shift discussions between managers and 
auditors away from management’s evaluation process to what matters most to investors - 
the risk that material misstatements in the company's financials won't be prevented or 
detected in a timely manner. 

By the way - managers and auditors should talk. And not just managers, but audit 
committees should have a healthy and ongoing dialogue with their auditors about the 
company’s internal controls. There is no auditor independence rule, or any other rule or 
standard, that stands in the way of this kind of useful communication. 

The comment periods for both the Commission and the PCAOB proposals closed on the 
same day - February 26 of this year. The Commission received 205 comment letters 
from a broad cross-section of investors, small companies and large companies, 
accountants, lawyers, regulators, and academics. About 70% of the respondents to the 
Commission’s proposed guidance also provided comments to the PCAOB on its 
proposed auditing standards. The percentage that commented to both of us would have 
been higher, except that we received 48 letters from a class at the University of 
Wisconsin, who inexplicably found writing to the SEC a more appealing assignment than 
commenting to the PCAOB. 

In our outreach to small business throughout this process, the SEC has been aided by the 
exceptional work of our Office of Small Business Policy in the Division of Corporation 
Finance. The Office of Small Business Policy is focused on making sure that the unique 
needs of small business are reflected in our rules, and in the interpretations and guidance 
we provide to the public. The Office of Small Business Policy served as the secretariat 
for the Commission’s Advisory Committee on Smaller Public Companies, which issued 
its report to the Commission in April 2006. That report was focused on the problems 
with section 404 implementation in a systematic way, and it has informed many of the 
solutions that we are now preparing to put into effect. 

Two months ago, as we neared the completion of our work on our 404 implementation 
reforms, the Commission held an open meeting to review the general nature of the public 
comments and the remaining open items that needed to be addressed. Chairman Olson 
and Jeff Steinhoff, the Managing Director for Financial Management and Assurance at 
the Government Accountability Office, also participated in that meeting. 

Now that the SEC and the PCAOB have finished this collaborative work, and the SEC's 
new guidance for management is approved, all that remains is for the new PCAOB 
standard to be exposed for public comment under the SEC's own approval process. I 
expect that AS 5 will be approved in final form this summer, but if it is not, we'll once 
again postpone the requirement that smaller public companies have a section 404 audit 
until the new auditing standard is available, with plenty of time for them to prepare. 
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Of course, the refonns that we have made can be successful only if they are implemented 
properly by companies and their auditors. The manner in which the PCAOB conducts its 
inspections of auditors will be of critical importance in influencing how auditors 
implement the new AS 5. The Commission will be carefully monitoring the 
implementation to ensure that the sought-after cost savings are achieved. 

As this Committee is aware, the Commission has carefully phased in application of the 
404 reporting requirements. We have repeatedly deferred 404 compliance for small 
companies. The very positive result of our determination to phase in 404 for smaller 
companies is that we and they have had the opportunity to field test the requirements 
first. Now, we’re using what we've learned to lessen the burden for smaller companies 
that will eventually have to comply with 404. 

We have little doubt the SEC's new guidance and the new PCAOB standard will be of 
significant help to small companies when, beginning with their SEC annual filings in 
2009, they eventually comply with the audit provisions of 404. In the meantime, for their 
filings in 2008, they will have to comply only with the management assessment portion 
of 404. And for this purpose, our new guidance will be especially helpful. It's written in 
plain English. It suggests that certifying officers at small companies ask themselves two 
basic questions: 

First, do my employees understand what they need to do to prepare reliable financial 
statements? 

Second, what information do I need to be sure they’ve done those things? 

The answers to these questions needn’t be complicated or costly. And certainly our 
guidance won't make them so. In fact, the guidance clearly highlights the areas where 
cost-effective implementation has been a challenge for small companies in the past, so 
that these pitfalls can be avoided. And it explains how a small company might approach 
404 differently than a large company. For example; 

• A smaller company would probably follow fewer and different steps in 
evaluating whether its controls will provide reasonable assurance about the 
reliability of its financial reports. 

• Management in a smaller company can go about obtaining information on 
whether its controls operate as designed in different and less elaborate ways 
than would be necessary in a large company. 

• The documentation needed to provide reasonable support for a smaller 
company's controls will normally be less than what's required in a larger 
company. 

None of this should be unduly difficult for most small companies, and it most certainly 
does not require the 404 audit that has had smaller companies so concerned about cost. 
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As we meet here in mid-2007, the requirement of an internal control audit under section 
404 won't apply to smaller public companies with calendar-end fiscal years until their 
filings in the spring of 2009, almost two years from now. In the meantime, those smaller 
companies can begin to get ready for full SOX 404 compliance by undertaking the 
company's own assessment of its internal controls, beginning with their SEC reports in 
2008. 

So in response to suggestions that the Commission should extend 404 compliance for 
another year, the answer is that smaller companies won't be required to come into full 
compliance with SOX 404 until their reports due in March 2009. 

This schedule gives smaller companies the benefit of doing an initial internal assessment 
of their controls without the added burden and cost arising from an external audit. We 
fully expect that, by the end of 2008, management’s familiarity with the 404 process, and 
its documentation of internal controls, will make it easier and less expensive to do an 
external audit than it would have been under the previous system. 

The goal of our collective efforts in this area is to implement section 404 just as Congress 
intended: in the most efficient and effective way to meet our objectives of investor 
protection, well-functioning financial markets, and healthy capital formation by 
companies of all sizes. We won't forget the failures that led to the passage of the 
Sarbanes-Oxley Act in the first place. And we won't forget that for small business to 
continue to prosper in America, both strong investor protection and healthy capital 
formation must go hand in hand. 

The reforms we’re making to the SOX 404 process are intended to be of direct benefit to 
America's small businesses - and the millions of Americans who work for them, invest in 
them, and benefit from all that they provide to our economy. We're re-orienting 404 to 
focus on what truly matters to investors - and away from expensive and unproductive 
make-work procedures that waste investors' money and distract attention from what's 
genuinely material. No longer will the 404 process tolerate procedures performed solely 
so someone can claim he considered every conceivable possibility. 

These past few weeks have witnessed several positive steps for small business at the 
SEC. Not only are we approaching the finish line in our work to rationalize and improve 
the 404 process for smaller companies, but also we’re tackling several other issues of 
importance to our nation’s small businesses. The most important of these is our initiative 
to broaden small business access to the U.S. capital markets. 

In the last few weeks, the Commission has voted to propose six separate measures to 
modernize and improve capital raising for small business, and to simplify SEC reporting 
for small business. Many of these proposals would implement key recommendations 
made by the Commission’s Advisory Committee on Smaller Public Companies. The 
small business improvements that the SEC has very recently proposed include: 
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• Giving small businesses access to the expedited “shelf’ registration process for 
their own securities offerings, which previously was available only to big 
companies. 

• Cutting paperwork for thousands of small businesses, by allowing them to raise 
capital in a private offering after filing a simplified Form D online. 

• Establishing shortened holding periods for restricted securities, making it easier 
for small business shareholders to put their securities on the market sooner and 
hopefully reducing the discount that smalt businesses must absorb to sell 
restricted securities. 

• Giving issuers the benefit of a new, limited offering exemption from Securities 
Act registration requirements for offerings and sales of securities to a newly 
defined category of “qualified purchasers” in which limited advertising would be 
permitted. 

• Eliminating the limit on the number of employees who can receive stock options 
from their fast-growing private firms, improving the ability of emerging growth 
companies to attract and retain talent without prematurely triggering the 
requirements of the Exchange Act. 

• Providing a simplified system of disclosme for almost 1,600 additional smaller 
public companies, an increase of over 45% in the number of small companies that 
are currently eligible. 

This focus on capital formation and the removal of obstacles to the growth of small 
businesses is appropriate given the historic importance of small business in the United 
States as a driver of economic activity, itmovation, and job creation. Our concerns for 
small business go hand in hand with our responsibility to protect investors. It is, after all, 
investors who are injiued and whose money is lost when the small businesses in which 
they invest can’t get affordable access to new capital. 

Madam Chairwoman, the SEC takes equally seriously each element of its tripartite 
mission; investor protection, efficient markets, and healthy capital formation. The 404 
reforms, the capital raising improvements, and the reporting simplifications we've 
proposed to benefit small business will, I am certain, help our country to accomplish all 
three of these objectives. 

Thank you again for the opportunity to speak on behalf of the Commission. I would be 
happy to answer any questions that you may have. 
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Chairwoman Velazquez, Ranking Member Chabot, and Members of the Committee: 

I am pleased to appear on behalf of the Public Company Accounting Oversight 
Board ("PCAOB" or the "Board") to speak about the impact of the Sarbanes-Oxley Act 
of 2002 (the “Act”) on small business, and, in particular, the PCAOB’s oversight of small 
audit firms and its auditing standard on internal control over financial reporting. I am 
also pleased to join Chairman Cox before you for today’s hearing on “Sarbanes-Oxley 
Section 404: Will the SEC’s and PCAOB’s New Standards Lower Compliance Costs for 
Small Companies?” The PCAOB works closely with the Securities and Exchange 
Commission (“SEC”) to achieve our shared goal of protecting the interests of the 
investing public in the preparation of informative, accurate and independent audit 
reports on public company financial statements. 

I. Introduction and Background 

This Committee’s focus on small business, and its particular focus today on the 
impact of the Act’s internal control provisions, are both appropriate and timely. Last 
month, the PCAOB replaced its auditing standard on internal control over financial 
reporting, which 1 will later describe in greater detail. A priority concern that triggered 
that action is the desire to assure that the audit mandated by the Act can be conducted 
in a manner consistent with the size and complexity of America’s small publicly traded 
companies. The market will bear out how the new standard affects overall audit costs, 
but in revising its standard, the PCAOB has been committed to providing for a sound 
audit that gives auditors of small companies the flexibility they need to design and 
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perform cost-effective audits that are tailored to the unique attributes of small business 
while still achieving the important objectives of the audit. 

Madam Chairwoman and Committee members, we see two important 
dimensions to the PCAOB focus on small business. First, of the 1 ,000 plus domestic 
audit firms that have registered with the PCAOB, the ovenwheiming majority are small 
firms. While our experience in inspecting these firms varies, we are reassured to 
discover that many very small firms provide high quality audits for their clients, many of 
whom are small businesses. The second dimension of our small business focus is our 
recognition that these small businesses constitute the largest segment of entities 
affected by our audit standards, and we need to be cognizant of their needs as we 
develop the standards. 

With more than half of all American households invested in U.S. public 
companies,^ the discoveries of financial reporting and auditing improprieties at 
numerous public companies earlier this decade swelled in 2002 to a national crisis of 
confidence in the integrity and reliability of public companies’ financial statements. 
Widespread investor risk aversion across markets adversely affected innovation and the 
economy more broadly.- This led to a predictably strong response on the part of the 


^ Due to the expansion of defined contribution plans and other incentives, nearly 57 million U.S, 
households ovun stocks directly or through mutual funds, according to a study by the Investment 
Company Institute and the Securities Industry Association, See Equity Ownership in America: 2005 
(November 2005), available at http://www.ici.org/pdf/rpt_05_equity_owners.pdf. 

By all measures, the forward risk premium for the S&P 500 swelled in October 2002 to nearly 
double the historical mean. The forward risk premium reflects the additional risk that investors perceive 
exists in the stock market, as compared to the bond market. See Monthly Earnings Report, Lehman 
Brothers, at 72 (April 7, 2004). The effect of this risk aversion was not limited to U.S. markets. For 
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investing public, as well as public company boards, the accounting profession, 
regulators, and Congress. There was an increased recognition of the need to bolster 
controls over financial reporting and bring an enhanced focus to corporate governance. 
Congress reacted by passing the Act, which among other things established the 
PCAOB to replace the accounting profession's self-regulatory model with an 
independent oversight system. 

The PCAOB’s mandate is to oversee the auditors of public companies, in order 
to protect the interests of the investing public in the preparation of informative, accurate 
and independent audit reports on public company financial statements. The PCAOB 
does not set accounting standards or regulate disclosures by public companies; rather, 
its role is to improve the quality and reliability of public company audits, so that investors 
can have more confidence in audited financial statements. High quality financial 
disclosure by public companies is a cornerstone of U.S. capital markets and is 
necessary for the continued growth and competitiveness of the U.S. economy. 

With that brief history as context, I would like to devote my time today to 
describing the PCAOB's programs, with a particular focus on the PCAOB’s approach to 
small audit firms. In addition, I will describe the PCAOB’s efforts, together with the 
SEC, to implement the provisions of the Act related to internal control, again with a 


example, in 2002 it led to the collapse of Germany’s Neuer Markt, a young stock market designed to 
provide capital opportunities for small European companies and thus to compete with U.S. markets for 
shares of new “dotcoms" and other technology companies. See Benoit, B., Skorecki, A., and Stafford, P., 
“Deutsche Borse to Close Neuer Markt Next Year,’ Financial Times (September 27, 2002). 
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particular focus on preparations for small companies and their auditors to implement 

those provisions, according to the timetable established by the SEC. 

II. The PCAOB’s Auditor Oversight Programs Foster a Dialogue with Small 
Audit Firms to Help Them to Improve Their Audits and Compete in the 
Market to Provide Public Company Audit Services. 

Subject to the oversight authority of the SEC, the Board is responsible for - 

• Registering audit firms that prepare audit reports for U.S. public companies; 

• Establishing, by rule, auditing and related professional practice standards relating 
to the preparation of audit reports for U.S. public companies; 

• Conducting inspections of registered firms; 

• Conducting investigations of, and imposing appropriate sanctions where Justified 
upon, registered firms and associated persons of such firms. 

I will focus my remarks today on the PCAOB's oversight and interaction with, 

small firms in particular. 

A. More Than 1,700 Accounting Firms Have Registered with the PCAOB. 

Early concerns that independent oversight might deter firms, particularly smaller 
firms, from continuing to audit public companies have not borne out. On the contrary, 
since the PCAOB opened its doors in January 2003, it has registered more than 1,700 
accounting firms that audit, or wish to audit, U.S. public companies. Of these firms, 
about 1,000 are U.S. firms. The firms vary dramatically in size. Some are multi-office 
regional firms with several, and sometimes a great number of, partners and professional 
staff, and others are sole practitioners with no professional staff. Only about 150 of 
these firms had more than five public company clients at the time they registered. In 
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addition, more than 450 of these firms registered even though they were not the aucSor 
of record for a public company at the time they registered.®' 

The PCAOB has observed that the market is improving for small audit firms 
registered to audit U.S. public companies. The Big Four firms have reduced their public 
company audit client base by more than 1,000 clients since Arthur Andersen’s demfee. 
in the same period, the next four and even smaller firms have increased the number of 
public companies that they audit: the next four have added more than 250 audit clients 
among them, and smaller firms have taken on more than 580 audit clients.- Indeed, 
within the last year, two registered firms have grown their audit practices to such an 
extent that they now issue audit reports for more than 100 public companies, which 
triggers the requirement under the Act and the Board’s rules that the Board conduct 
annual inspections of those firms. Ten U.S. firms and one non-U.S. firm are now 
subject to annual inspection. 

Smaller firms are likely to continue to seize opportunities to expand their 
businesses by taking on new clients appropriate to the size and sophistication of the 
firms’ practices. At the same time, for their business growth to reach its full potential, 


® Importantly, the PCAOB’s rules related to registration were designed with care not to impose 
unnecessary impediments for small firms. Thus, while a registering firm must demonstrate that the 
Board's approval of its application is consistent with the Board’s responsibilities under the Act to protect 
the interests of investors and to further the public interest in the preparation of informative, accurate, and 
independent audit reports, firms need not have a current public company audit client in order to register. 

See Yellow Card Trend Alert, Glass, Lewis & Co., at 5 (May 21, 2007), According to this study by 
Glass, Lewis & Co., since Arthur Andersen’s demise. Big Four firms reduced their public company audit 
clients by 1 ,030, the next four firms added overall, net, 266 public company audit clients, and smaller 
firms realized a net gain of 588 public company audit clients. 
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the firms must understand and know what is expected of them within the Sarbanes- 
Oxley and PCAOB framework. For smaller firms, the adjustment to that framework can 
give rise to issues and questions different from those for the larger firms. 

B. The PCAOB Uses Outreach to Small Firms and the Small Business 
Community to Provide Information About PCAOB Activities and Seek 
Insight on Small Business Concerns and Challenges. 

The PCAOB has established an ambitious outreach effort directed toward small 
registered firms and their audit clients to address their unique issues and questions. 
These one- and two-day discussion sessions, called Forums on Auditing in the Small 
Business Environment, follow an in-depth curriculum on PCAOB activities and 
developments. They have provided an avenue for small registered firms and small 
public companies to obtain a better understanding of the workings of the PCAOB, and 
they have fostered a robust dialogue that has given the PCAOB valuable insights to 
apply in its programs. In addition, I believe the Forums have better equipped firms with 
information to address the challenges of the regulatory environment. 

To date, the PCAOB has held 21 Forums in 14 metropolitan areas across the 
country. Nearly 2,000 people involved in the small business community have attended 
the Forums, including about 1 ,500 auditors from smaller public accounting firms. Based 
on positive feedback from participants, the PCAOB intends to continue to hold Forums 
to further the PCAOB’s dialogue with such firms and companies. 
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C. The PCAOB’s Supervisory Inspection Program Helps Small Firms 
Focus on Audit Quality Necessary to Compete in the Market to 
Provide Public Company Audit Services. 

While the Forums reach small firm auditors in a group environment, PCAOB 
inspections foster an even deeper, one-on-one dialogue between the PCAOB and small 
registered firms. Under the Act and the Board’s rules, firms that audit the financial 
statements of 100 or fewer public companies are subject to inspection at least once 
every three years. The PCAOB has taken a supervisory approach toward implementing 
its inspection program. In these inspections, the PCAOB has observed first-hand how 
some small firms distinguish themselves professionally and competitively by performing 
high-quality audits. In other cases, PCAOB inspections identify areas in which firms 
should do better. For those firms that strive to improve the quality of their audits and 
their ability to compete for public company audit clients, the supervisory dialogue 
throughout the inspection process helps them to do so. 

While the PCAOB's inspections are the core of its supervision of registered firms, 
these inspections take place largely outside the public view. This is because the Act 
mandates a significant degree of confidentiality relating to inspection information. One 
particular provision relates to any portion of a PCAOB inspection report that describes 
criticisms of the firm's system of quality control. Under the Act, a firm has one year to 
show that it has satisfactorily addressed those criticisms, and if it does so those 
criticisms remain nonpublic. This remediation mechanism reflects Congress's policy 
decision to use the possibility of public disclosure as an incentive to firms to address 
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systemic problems.^' It has proven to be a key tool to motivate firms to do better. When 
the PCAOB identifies problems, firms typically take those criticisms seriously and make 
substantial changes within a year. 

Under the Board’s supervisory approach, it is able to use its inspection process 
to address most of the individual, or isolated, auditing problems identified, without the 
need to invoke its disciplinary authority to enforce applicable laws and standards. For 
example, when an individual audit is not up-to-grade, inspectors discuss with the fmx\ 
precisely what the deficiency is. Sometimes this means a firm will perform additional 
audit procedures to shore up a weak audit. When the problem relates to an individual 
auditor, a firm may provide additional training to or supervision of the person involved or 
take other action the firm determines is appropriate. Thus, the PCAOB inspection 
process has been able to prompt and facilitate firms' achievement of significant real- 
time improvements, often even before an inspection is concluded. 

D. The PCAOB Develops Auditing and Related Professional Practice 
Standards with the Needs and Challenges of Small Firms in Mind. 

The Act directs the Board to establish certain standards for use by auditors of 
public companies. Those include standards for auditing and related attestation work, 
standards for quality controls, ethics standards, and independence standards, in order 


In order to give the public an understanding of how this incentive works, last year the Board 
described its experiences in monitoring firms’ efforts to address problems identified in the first year of 
inspections. See PCAOB Release No. 104-2006-078, Observations on the Initial Implementation of the 
Process for Addressing Quality Control Criticisms within 12 Months After an Inspection Report, March 21 , 
2006, available at http;//www.pcaobus.org/lnspections/ Public_Reports/2003/2006-03-21_Release_104- 
2006-078,pdf; see also PCAOB Release No. 104-2006-077, The Process for Board Determinations 
Regarding Firms' Efforts to Address Quality Control Criticisms in Inspection Reports, March 21, 2006, 
available at http;//www.pcaobus.org/lnspections/2006-03-21_Release_104-2006-077.pdf. 



65 


PCAOB Testimony Page 9 

June 5, 2007 

to ease firms’ transition to independent oversight, early in the Board’s first year of 
operation, in 2003, the Board adopted as interim standards certain auditing and related 
professional practice standards that had been developed and adopted by the auditing 
profession prior to the establishment of the PCAOB. These are standards with which 
audit firms large and small were already familiar, as they existed on April 16, 2003.- 

Since adopting this body of pre-existing standards, the Board has adopted five 
new standards- as well as new ethics and independence rules relating to tax services 
and contingent fees. To develop new standards and rules, the Board uses a standards- 
setting process that provides for public input at a variety of stages, in particular, three 
times a year the Board holds a public meeting with its Standing Advisory Group.®' The 
advisory group’s 31 members are drawn from a cross-section of the nation’s companies 
- small and large - as well as auditors from small and large accounting firms, investors 
and their advisors, academics, and others. These individuals share their informed 


^ In summary, these are: Generally Accepted Auditing Standards (or, “GAAS") as previously 
established by the American Institute of CPAs ("AICPA”); Attestation Standards and related 
interpretations and Statements of Position as previously adopted by the AICPA; the AlCPA’s Statements 
on Quality Control Standards and certain AICPA SEC Practice Section membership requirements; certain 
provisions of the AlCPA's Code of Professional Conduct on integrity and objectivity, and the standards 
and interpretations of the Independence Standards Board. 

Specifically, the Board's Auditing Standard No. 1 relates to references in auditors’ reports to the 
standards of the PCAOB; Auditing Standard No. 2 (and Auditing Standard No. 5, which replaces it) 
relates to audits of internal control over finandal reporting; Auditing Standard No. 3 relates to audit 
documentation, and Audit Standard No. 4 relates to auditors' reporting on whether a previously reported 
material weakness continues to exist. They are available on the Board’s Web site at 
http://«(Ww.pcaobus.org/Standards/Standards_and_Related_Rules/ index.aspx, along with the Board’s 
new ethics and independence rules. 

- The Board convened its Standing Advisory Group pursuant to Section 103(a)(4) of the Act. The 
Group consists of experts in auditing and financial reporting, including individuals with experience at 
institutional investors, accounting firms, and public companies. 
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opinions on how the Board, consistent with its mandate, can improve the quality of 
audits, including by advising on best practices and emerging issues. Many of the 
advisory group’s discussions have focused on matters related to small business and the 
audits of small registered firms. On occasion, they have also included dedicated panels 
of small firm auditors who can offer their insights on best practices and their 
experiences with the unique challenges the small business community faces.- 

In addition to seeking the views of its advisory group members and other 
interested persons, the Board seeks public comment on proposed new standards and 
rules, makes those comments publicly available on its Web site, and considers them 
before adopting final standards or rules. Board standards are also subject to SEC 
review, and they do not go into effect unless they are approved by the SEC.'“^ 

III. The PCAOB’s Role in the Act’s Internal Control Requirements 

I would like to devote the remainder of my time today to the PCAOB’s role in 
implementing, through its auditing standards, the provisions of the Act related to internal 
control over financial reporting. In particular, Section 404 of the Act requires public 
companies annually to provide investors an assessment of their internal control over 
financial reporting, accompanied by an auditor’s attestation on the same subject. 


- The Board also participates as an observer of other agencies' initiatives to examine issues 
germane to the small business community, including the SEC’s Advisory Committee on Smaller Public 
Companies, the Committee of Sponsoring Organization's Task Force on Guidance for Smaller Public 
Companies, and the Financial Accounting Standards Board’s Small Business Advisory Committee. 

In most cases, applicable securities laws and rules provide for the SEC to publish PCAOB rules 
and standards for public comment as part of the SEC’s consideration and approval process. 
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A. The Act’s Internal Control Reporting and Auditing Requirements 

The term “internal control over financial reporting” refers to a company’s system 
of checks and processes designed to protect corporate assets, keep accurate records 
of those assets as well as its financial transactions and events, and prepare accurate 
periodic financial statements. Investors can have much more confidence in ttie 
reliability of a company’s financial statements if management demonstrates that it 
maintains adequate internal control over bookkeeping, the sufficiency of books and 
records for the preparation of accurate financial statements, adherence to rules about 
the use of company assets, and the safeguarding of company assets. Indeed, research 
shows that disclosures about the reliability of internal control have a significant effect on 
companies’ cost of capital.^' 

Companies have been required to have internal control over their accounting 
since Congress enacted the Foreign Corrupt Practices Act in 1 977. There is no doubt, 
however, that the Sarbanes-Oxley Act’s requirement for annual assessments, and 
auditor attestations to those assessments, intensified scrutiny of companies' internal 
control over financial reporting. 

As directed by Section 404(a) of the Act, in June 2003 the SEC established rules 
describing companies’ required assessments. In March 2004, the PCAOB implemented 

See Ashbaugh-Skaife, Collins, Kinney and LaFond, The Effect of Internal Control Deficiencies on 
Firm Risk and Cost of Equity Capital (April 2006, updated February 2007). Specifically, the researchers 
found that when companies report they have corrected a previously reported material weakness in 
internal control, their cost of capital goes down on average 1 .5 percent. Conversely, when companies 
report material weaknesses in audited financial reports after they had previously reported in unaudited 
statements that internal control was effective, their cost of capital goes up on average almost 1 percent 
(93 basis points). 
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Sections 103, requiring an auditing standard on internal control, and 404(b) of the Act 
by establishing a new auditing standard - Auditing Standard No. 2 - to provide for an 
audit of internal control over financial reporting integrated with the audit of the financial 
statements themselves. The SEC approved Auditing Standard No. 2 in June 2004.^ 
For large, established companies - which the SEC calls accelerated filers - the initial 
assessments and attestations were required by SEC regulations to be included in their 
annual Form 10-K filings for fiscal years ending after November 14, 2004.—' 

The SEC has delayed implementation for smaller companies, Le., non- 
accelerated filers. Such companies have until they file financial statements for a fiscal 
year ending on or after December 15, 2007, to file their first management assessments 
of internal control. In addition, the SEC will not require such companies to file audit 
reports on such assessments until they file financial statements for a fiscal year ending 
on or after December 15, 2008.— 


“ See SEC Release No. 34-49884, Order Approving Proposed Auditing Standard No. 2, An Audit of 
Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements 
(June 17, 2004). 

^ Accelerated filers (and large accelerated filers) generally include companies with an aggregate 
market value of voting and non-voting common equity held by non-affiliates of the issuer (referred to as 
"public float") of $ 75 million or more, as of the last business day of the issuer's most recently completed 
second fiscal quarter. See SEC Exchange Act Rule 12b-2, 17 C.F.R. 240.12b-2; see also SEC Release 
33-8644, Revisions to Accelerated Filer Definition and Accelerated Deadlines for Filing Period Reports 
(December 21 , 2005) (amending definition of “accelerated filer" to distinguish between “accelerated filers” 
and “large accelerated filers,” which have a public float of $700 million or more). According to the SEC, 
approximately 44% of domestic companies filing periodic reports are non-accelerated filers. See SEC 
Release No. 33-8760, Internal Control over Financial Reporting in Exchange Act Periodic Reports of Non- 
accelerated Filers and Newly Public Companies (December 15, 2006), at 1 1 . 

— See SEC Release No. 33-8760, Internal Control over Financial Reporting in Exchange Act 
Periodic Reports of Non-accelerated Filers and Newly Public Companies (December 15, 2006). 
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B. Although the Act’s Internal Control Reporting Requirements are Not 
Yet Applicable to Small Companies, the PCAOB Has Used its 
Experience Monitoring Large and Mid-Cap Company Implementation 
to Revise Its Auditing Standard and Develop Tailored Guidance with 
Small Companies In Mind. 

Notwithstanding this delay, there is considerable concern among small public 

companies about implementing the Act’s internal control reporting requirements. For its 

part, the PCAOB has monitored implementation by companies that are subject to the 

requirements, among other things with a view toward easing implementation challenges 

smaller companies may face. To this end, based on that experience, the PCAOB 

recently revised its auditing standard on internal control and is developing specialized 

guidance and training for auditors of small companies. 

1. The PCAOB Has Monitored Auditors’ impiementation of 
Auditing Standard No. 2 and, as Needed, Provided Guidance. 

In the nearly three years since the SEC’s rule on management assessments of 
Internal control and the Board’s related auditing standard went into effect for 
accelerated filers, the Board has closely monitored the challenges that those companies 
and their auditors have faced. As appropriate, the PCAOB has provided additional 
guidance to facilitate implementation. In this regard, the Board’s staff issued five sets of 
interpretive guidance that answer 55 frequently asked technical questions on the 
implementation of Auditing Standard No. 2.— In addition, on May 16, 2005, the Board 

® These questions and answers are available at http://www.pcaobus.org/Standards/ 
Standards_and„Related_Rules/Auditing_Standard_No.2.aspx. 
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issued a policy statement describing ways auditors can make their internal control 
audits as effective and efficient as possible.^ 

The PCAOB has also used its inspections of larger firms to monitor firms’ 
implementation of the Board’s auditing standard on internal control. To this end, the 
PCAOB has issued two reports on its inspections and other monitoring, on November 
30, 2005, and April 17, 2007. Those reports describe best practices observed in the 
first and second years, respectively, as well as providing additional guidance on how 
auditors can make their work more efficient.— 

The PCAOB's monitoring has also included participating, along with the SEC, in 
two roundtable discussions with representatives of public companies, auditors, investor 
groups, and others; meeting with its Standing Advisory Group; receiving feedback from 
participants in the Board's Forums on Auditing in the Small Business Environment; and 
reviewing academic, government, and other reports and studies, including the 
Government Accountability Office's April 2006 report on Sarbanes-Oxlev Act: 
Consideration of Key Principles Needed in Addressing Implementation for Smaller 


™ See PCAOB Release No. 2005-009, Policy Statement Regarding Implementation of Auditing 
Standard No. 2 (May 16, 2005). 

— See PCAOB Release No. 2005-023, Report on the Initial Implementation of Auditing Standard 
No. 2 (November 30, 2005), available at http://www.pcaobus.org/Rules/Dooket_014/2005-11- 
30_Release_2005-023.pdf; PCAOB Release No. 2007-004, Report on the Second-year Implementation 
of Auditing Standard No, 2 (April 18, 2007), available at httD.'//www.pcaobus.oro/lnspections/ 
Other/2007/04-18_Release_2007-004,pdf. Importantly, in the first of those reports, issued after the first 
year of implementation, the Board found that many auditors faced tight deadlines, staffing and other 
resource constraints, and significant training needs. Moreover, their clients faced similar hurdles that 
were, in many cases, exacerbated by having to make up for deferred maintenance on internal control 
systems that had not kept up with the company’s growth and development. 
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Public Companies, and the Final Report of the SEC’s Advisory Committee on Smaller 

Public Companies issued the same month.’® 

2. The Board Has Revised Its Standard, to Promote Efficiency 
and Eliminate Unnecessary Procedures. 

The Board is determined to make internal control audits as cost-effective as 

possible for companies that are required by the SEC’s rules to obtain an audit report on 

internal control. Therefore, based on its experience monitoring implementation, on 

December 19, 2006, the Board proposed a revision of its auditing standard on internal 

control, along with related amendments and rules. The Board received 175 comment 

letters on the proposal. After considering these comments, as well as the input 

provided by the SEC at an Open Meeting on April 4, 2007, the Board adopted a new 

auditing standard - Auditing Standard No. 5 - on May 24, 2007. If approved by the 

SEC, the new standard will replace Auditing Standard No. 2 in its entirety.’®' 

One of the primary goals of the new standard is to provide explicit guidance on 

scaling audits to reflect the attributes of smaller, less complex companies. In addition, 

the new standard has three other objectives. Specifically, the new standard - 

• Focuses the audit on the matters most important to internal control - 

The new standard focuses auditors on those areas that present the 
greatest risk that a company’s internal control will fail to prevent or detect 
a material misstatement in the financial statements. It does so by 


See GAO, Sarbanes-Oxlev Act: Consideration of Key Principles Needed In Addressing 
Implementation for Smaller Public Companies (April 2006, GAO-06-361); Final Report of the Advisory 
Committee on Smaller Public Companies (April 23, 2006), available at 

http://www,sec.gov/info/smallbus/acspc/acspc-finalreport.pdf. 


~ On May 23, the SEC adopted guidance that can be used by management in making the 
assessment required by Section 404(a) of the Act. See SEC Release No. 33-8762, Management’s 
Report on Internal Control Over Financial Reporting (December 20, 2006). 
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incorporating certain best practices designed to focus the scope of the 
audit on identifying material weaknesses in internal control, before they 
result in material misstatements of financial statements, such as using a 
top-down approach to planning the audit. It also emphasizes the 
importance of auditing higher risk areas, such as the financial statement 
close process and controls designed to prevent fraud by management. At 
the same time, it provides auditors a range of alternatives for addressing 
lower risk areas, such as by more clearly demonstrating how to calibrate 
the nature, timing and extent of testing based on risk, as well as how to 
incorporate knowledge accumulated in previous years’ audits into the 
auditors’ assessment of risk and use the work performed by companies’ 
own personnel, when appropriate. 

• Eliminates unnecessary procedures - The Board examined every area 
of the internal control audit to determine whether the previous standard 
encouraged auditors to perform procedures that are not necessary to 
achieve the intended benefits of the audit. As a result, among other 
things, the new standard does not include the previous standard’s detailed 
requirements to evaluate management's own evaluation process and 
clarifies that an internal control audit does not require an opinion on the 
adequacy of management's process. 

• Simplifies the requirements - The Board’s new standard is shorter and 
easier to read. This is in part because it uses simpler terms to describe 
procedures and definitions. It is also because the standard has been 
streamlined and reorganized. 

These steps are designed to provide for a sound audit that gives auditors of 
small companies the flexibility they need to design and perform cost-effective audits that 
are tailored to the unique attributes of small business. 

3. The Board Plans Guidance for Auditors of Smali Companies. 

In 2006, even before the Board revised its auditing standard, it embarked on an 
initiative to develop tailored implementation guidance for audits of small companies, 
based on the experience and insights of small companies and auditors who have been 
and are currently going through the process of evaluating internal control as well as the 
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Board's inspection and other monitoring experience. The guidance is intended to 
emphasize the scalability of internal control audits at a practical level, by providing 
auditors with examples of how the internal control audit process can and should be 
scaled to fit the relative sizes of small companies, from those that are on the cusp of 
accelerated filer status to those that have merely a handful of employees. 

This initiative has progressed on a parallel track to the revision of the Board’s 
auditing standard. Thus, beginning in January 2007, the PCAOB’s focus group of 
auditors and small companies began evaluating an early prototype of the planned 
guidance, based on the Board's December 2006 proposal. The Board continues to 
develop this guidance in consultation with its focus group. The guidance will also be 
updated it in light of changes reflected in the standard as adopted. The PCAOB is 
targeting publication of the guidance later this year. 

Finally, the Board is exploring various means of facilitating training for auditors of 
smaller public companies on auditing internal control. With constructive, practical 
guidance, the Board hopes that small companies and their investors will be able to reap 
the benefits of internal control reporting without unnecessary costs. 

IV. Conclusion 

The PCAOB works hard to achieve the objectives Congress set for it in the Act. 
The oversight program it has in place is reducing the risk of financial reporting failures 
and renewing confidence in the financial reports of public companies and, ultimately, in 
the U.S. securities markets. The Board continues to assess its oversight programs, 
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however, and in doing so it takes into account the effect on, and perspective of, the 
small business community. As I have described, the Board has and will continue to 
make appropriate adjustments to assure that it achieves the objectives of the Act in the 
most effective and efficient manner possible. In particular, the Board is committed to 
ensuring that its standard on internal control lays the foundation for efficient audits that 
are cost-effective for small business and maintain the benefits intended by the Act. 
Thank you. I will be pleased to answer any questions. 
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Chairman Velazquez, Ranking Member Chabot and members of the Committee. Thank 
you for providing the opportunity to testify before you today on reforms to the Sarbanes- 
Oxley Act (SOX) Section 404 adopted by the Securities and Exchange Commission and 
Public Company Accounting Oversi^t Board. 

I am Jim Greenwood, President and CEO of the Biotechnology Industry Organization 
(BIO). I am privileged to be here today on behalf of BIO, an organization representing 
more than 1,100 biotechnology companies, academic institutions, state biotechnology 
centers and related organizations in 50 U.S, states and 31 other nations. BIO members are 
involved in the research and development of health care, agricultural, industrial, and 
environmental biotechnology products. TTie majority of BIO member companies are 
small, research and development oriented companies pursuing innovations that have the 
potential to improve human health, expand our food supply, and provide new sources of 
energy. The promise of biotechnology is immense, as our members combine biology and 
technology to deliver new treatments for unmet medical needs, improved crops that are 
more drought resistant and have reduced environmental impact, and create cheaper, more 
environmentally friendly fuels and consumer products. Biotech is one of the most 
innovative high growth sectors of our nation’s economy, and one in which the United 
States maintains a global leadership position. 

At the outset, let me mention that BIO appreciates the Committee’s efforts and vigilance 
regarding the implementation of Sarbanes Oxley Section 404. Also, my testimony today 
has greater specificity with respect to the PCAOB rules than it does the final rule 
approved by the SEC, as the SEC’s rule is not yet available for public viewing. I note 
that it is surprising that in this day and age it is not possible for a major Federal agency to 
make the text of the rule it has formally approved available on the same day in which it 
takes action. 

First, I’d like to start by providing a short answer to the Committee’s question, posed in 
the title of this hearing, as to whether or not the SEC’s and PCAOB’s new standards will 


Eye Sired N\V • Suite 400 • Wasbinglon, DC 2000.5-5938 • 202.962.9200 ♦ wvvw.bio.org 



76 


lower compliance costs for small compaities. In summary, the answer is a marginal 
“yes.” 

There has been considerable rhetoric from both the SEC and PCAOB that has 
accompanied these rules, and we appreciate the recognition of the many problems caused 
by the poor implementation of Sarbanes Oxley Section 404. The changes promulgated 
by the two agencies are well-intended, thou^ they appear modest in effect. Ultimately, 
the rhetorical promises offered can only be kept if there is an on-going, consistent effort 
and commitment to reducing unneeded audit and compliance costs. 

BIO fully appreciates and agrees with the Congressional intent behind Section 404 - to 
enhance investor protection and confidence. BIO members strongly support this goal. 

As this Committee well knows, though, where Section 404 has gone awry is in the 
implementation. The situation that many emerging biotech companies face is that funds 
that would be otherwise spent for core research and development of new therapies for 
patients are instead used for overly complex controls or unnecessary evaluation of 
controls. This legislation - for which I was a conferee in 2002 - was not intended to be a 
windfall for auditors, nor pile on the compliance costs for companies. As we all know, 
that was not our desire when we wrote this law. Indeed, the Senate Banking Committee 
report on the legislation specifically stated that with respect to Section 404, “the 
Committee does not int«rd that the auditor’s evaluation be the subject of a separate 
investigation or the basis for increased fees.” ' 

However, the scale of the problems that Section 404 has created suggests that Congress 
should closely monitor the implementation of these revisions to ensure that its original 
intent is achieved. It is critical to ensure that these new rules provide the greatest 
possible flexibility and scalability for small public companies. 

Consequences of One-Size-Fits-All Approach to the Industry and U.S. Competitiveness 

The one size fits all approach originally implemented by the PCAOB in its Auditing 
Standard #2 (AS-2) created checklist mentality to audits that increased both financial and 
manpower costs without appreciably improving financial reports or internal controls. 
These costs have been recognized, and documented last year, by the SEC Advisory 
Committee for Smaller Public Companies (Advisory Committee), which found that, 
“with more limited resources, fewer internal personnel and less revenue with which to 
offset both implementation costs and the disproportionate fixed costs of Section 404 
compliance, [small] companies have been disproportionately subject to the burdens 
associated with Section 404 compliance.”^ 

In addition, the U.S. Government Accountability Office issued a significant study last 
April that found that many small businesses had seen audit costs jump significantly, due 


‘ S. Rep. No. 107-205 at 31 (2002). 

^ Final Report of the Advisory Committee on Smaller Public Companies. April 2006. Page 23, 
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in large part to the implementation, rather than the compliance with the intent, of Section 
404.^ 

For most biotechnology companies, the actual costs of Section 404 compliance, including 
both internal costs as well as external auditor costs, are substantial. In fact, the 
opportunity costs of Section 404 for smaller companies can be even greater, impeding the 
ability to invest in and sometimes, to continue ongoing, critical research and development 
activities. Another member company’s experience shows the opportunity costs of Section 
404 compliance. This company not only spent approximately $500,000 on its external 
attestation of internal controls but also had to endure additional costs in terms of (i) the 
reassignment of laboratory research personnel to perform internal control work dictated 
by AS-2 and the company’s external auditors, (ii) the postponement of the hiring of 5-10 
additional researchers, and (iii) the delay of promising R&D programs. Such diversion of 
resources away from research activities can delay critical product development and has, 
in turn, a detrimental effect on a company’s ability to raise capital. 

Biotech companies are at the forefront of developing new treatments for many diseases, 
and biotech companies presently are engaged in over 350 clinical trials for over 200 
diseases, from cancer to multiple sclerosis. 

Under the requirements of Section 404, significant time and money are spent to put in 
place complex systems and processes dictated by the AS-2and required by external 
auditors. Let me give one example as a reminder of manifest flaws of the current system: 
one of BIO’s member companies had five employees working on Section 404 compliance 
at a cost of approximately $1 million per year. This company estimated that its controller 
spent approximately 35% of his time on Section 404, while the CFO spent approximately 
20% of his time. To complete the mandated internal control processes and the “checklist” 
dictated by AS2, the company had to increase its accounting staff by 40%. Further, this 
company reports only a 7% decrease in costs in year two as compared to its first year of 
compliance. 


It is also the experience of BIO members that the current problems with Section 404 are 
not merely growing pains where the costs and burdens will decrease once the auditors 
and companies become more familiar with the process and requirements. The current 
implementation of Section 404 imposes the same requirements, steps and reviews on all 
companies, by the same individuals year after year. As a result, the costs are fixed and 
ongoing, impacting the long-term investment resources of microcap and smallcap 
companies. 

For the investors, their confidence and trust in public companies may have increased as a 
result of the passage of SOX as a whole and not necessarily due to Section 404. The other 
provisions in SOX include whistleblower protections, increased enforcement powers, 
auditor independence requirements and, perhaps most importantly, CEO and CFO 
certifications of company financial statements under section 302 of SOX. As we saw in 


^ U.S. General Accountability Office, “Sarbanes-OxJey Act: Consideration of Key Principles Heeded in 
Addressing Implementation for Smaller Public Companies.” April, 2006. GAO-06-361 
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the first and second years of Section 404 implementation, investors and the market 
generally had little market reaction when a company reported a “material weakness” in 
internal controls under Section 404. As discussed above, the costs of the implementation 
of Section 404, particularly for smaller public companies, appear to outweigh many of 
the benefits that are directly related to Section 404. 


SEC and PCAOB’s New Standards 


Scaled Reform Needed for Smaller Public Companies 

Both the SEC and PCAOB have taken steps to address the problems that have manifest 
firom the implementation of Section 404. BIO commends both the SEC and PCAOB for 
taking to the steps to address the critical compliance problems that Section 404 audits had 
been creating, particularly for small and newly public companies. Both agencies suggest 
that these new requirements are to be “scaled”, “risk-based” and “flexible”. While the 
SEC’s final guidance appears to provide a more flexible, principles-based set of rules for 
management, the new standards adopted by the PCAOB - while an improvement over the 
current standards - could still be improved to enhance flexibility, auditor jud^ent and 
consistency with SEC guidance. Furthermore, one could fairly say that in its revisions to 
its initial December 2006 draft, the PCAOB has taken a step bacL 

Removal of Small Company Definition - A Worrisome Signal? 

Included in both the Commission’s and the PCAOB’s proposals were objective measures 
auditors could use in determining what is a “smaller company” - mainly, one with a 
market capitalization of less than $700 million and reported annual revenues of $250 
million or less.'* This was consistent with the recommendation of the Advisory 
Committee on Smaller Public Companies who suggested that an objective test - 
particularly a “revenue filter” - be used as a tool to define a smaller public company when 
scaling the audit.^ 

Unfortunately, this definition of a small company has been removed fi'om the final 
PCAOB adopted rule. Ostensibly, this appears to have been done in order to encourage 
auditors to consider scaling the audit for the non-complex entities within large 
corporations. BIO certainly applauds that. 


See footnote 44 of SEC proposal. File No. S7-24-06. httD://www.!iec.gov/rule,s/DroDOsed/2006/33- 
8762.pdf and Paragraph 9 of PCAOB proposal. Release No. 2006-007. 
httD://www.pcaob,org/Rules/I>ocket 021/2006-12-19 Release No. 2006-007.pdf 


^ See page 15 of the Advisory Committee on Smaller Public Companies. 
httD://www.sec.gov/info/smallbus/acsDc/ac.sDc-finalreDort.pdf 
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But rather than maintaining the proposed objective deiSnition of a smaller company and 
then expanding it to include the subjective criteria that could also be applied to parts of 
larger companies, the PCAOB removed the objective criteria altogether. 

In other words, under the December proposal, the PCAOB had suggested no less than six 
indicators* that a company could receive audit treatment proportionate to a less complex 
company: 

- Market cap of $700 million and annual revenues of $250 million ^ 

- Few business lines; 

- Less complex business processes and financial reporting systems; 

- Centralized accounting functions; 

- Extensive involvement by senior management in the day-to-day activities of 
the business; and, 

- Few levels of management, each with a wide span of control 

In dropping any reference to market capitalization or annual revenues, the PCAOB 
appears to have deleted the only objective criteria for scalability included in the rule 
incomplete it may have been. In doing so, the PCAOB seems to have changed the 
presumption that a company meeting those thresholds is a “small company” and thus 
subject to a less burdensome audit to a presumption that everyone is subject to the fullest, 
most comprehensive audit - unless, they, the auditor - determines otherwise, using the 
subjective criteria in the rule. 

To its credit, the PCAOB nevertheless continues to use discuss smaller public company 
issues throughout the rule - at least thirteen times by our count. Yet it is a startling failure 
on PCAOB’s part that it chose to no longer provide any definition of smaller company, 
while maintaining the subjective definition of less complex companies, 

BIO is disappointed that the final rule by the PCAOB removed the only objective criteria 
it had. The lack of clear direction to auditors is one problem that could be solved by 
adoption of a bright line test in which smaller companies could be assured of the ability 
to avail themselves of the scaled, proportionate audit of internal controls. 

Maintaining the market capitalization and revenue criteria would have alleviated 
concerns with the potential conflict of interest relating to the incentives of the auditor 
who is charged with evaluating the “size and complexity of a company in planning and 
performing the audit” and also being the company providing the work.* In pursuing its 
incentive to maximize profits, an auditor has an economic incentive to determine a 
company too large and too complex, thus requiring an extensive audit mandating 
additional hours of billing, etc. 

^ See Paragraphs 9 and tO of PCAOB proposal Release No. 2006-007 (pages A 1-7 and A 1-8) 

’ See footnote 6 of PCAOB proposal in which they also reference definition of smaller public company as 
having a market capitalization of $787.1 million as used by the SEC Advisory Committee on Smaller 
Public Companies , Release No 2006-007 (page Ai-7) 

' See page 28 of the proposal. Proposal-2006-00 http.7Avww.pcaobus.org/Rules/Docket_02i/2006-12- 
19_Release_No._2006-007.pdf 
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In addition, some - like SEC Chief Accountant Conrad Hewitt as well as principals of the 
big accounting firms - have suggested auditors currently face unlimited exposure to legal 
liability and thus should receive some sort of limitation or cap on such liability.’ While 
we make no policy judgment on that issue at this time, the mere consideration does 
suggest an auditor has great incentive to be overly ambitious with its internal control 
opinion in an effort to protect itself fi'om such liability and the costs associated with 
litigation. 

BIO would also note that auditors under PCAOB scrutiny tend to worry much more about 
being found deficient for having been too lenient with their audit clients rather than for 
being criticized for having been too rigorous or burdensome in their decisions. 
Accordingly, there is no incentive for an auditor to scale its audit because there are no 
penalties for being overly aggressive and creating unnecessary costs in an audit. The 
PCAOB should strongly consider how it evaluates auditors and examine how it could 
provide an incentive to be more efficient. 

As result of this puzzling change, BIO believes that the new standards may do even less 
than the PCAOB’s initial December 2006 initial revisions to counterbalance the 
incentives auditors face to be oveizealous in their work. Consequently, while hoping for 
greater impact, it is tmclear that the PCAOB ’s rules will lead to substantially lower audit 
fees or reduced burden on emerging biotech companies. 

BIO believes a quantitative, objective standard for smaller public companies creates a 
much needed burden on the auditor to prove that a company falling within the pre- 
established thresholds has significant complexities that warrant a more detailed audit of 
the company’s internal controls. Establishing quantitative measures relieves the PCAOB 
of the full burden of determining if auditors are in fact using their judgment to ensure 
shareholders, who ultimately carry the costs of the audit, are receiving value from a more 
complex audit. 

It is BIO’s view that by establishing quantitative measures as part of the consideration in 
scaling the audit, the auditor should look at a company within the established measures as 
a non-complex unit before their walkthrough. During the walkthrough, an auditor would 
be forced to seek reasons to increase the depth of the audit due to particular complexities 
of the company rather than look at all companies as a complex unit rmtil proven 
otherwise by an auditor. 

Product Revenue: A Better Indicator of Complexity 

BIO has consistently advocated for scalability indicia that are most reflective of 
complexity. BIO supports the PCAOB ’swoA to include the scalability criteria and 
guidance throughout the auditing standard. In order to achieve the benefits of the 


’ See Taub, Stephen. CFO.com “SEC’s Hewitt; Indemnify the Big Four,” CFO.com, Stephen Taub 26 
January 2007; and www.pwc.com . “Global Capital Markets and the Global Economy: A Vision from the 
CEOs of the International Audit Networks” November, 2006. 
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scalable approach, it is imperative that the auditors be encouraged to do so throughout the 
audit. Doing so minimizes the combined threat of litigation and PCAOB examination 
based upon terms and definitions that are mandatory and inflexible, and discourages 
auditors fix>m using the maximum degree of checklist compliance. 

BIO recognizes the efforts made by both the SEC and PCAOB to affirmatively attempt to 
reduce the audit and compliance burdens on all companies, specifically by focusing on 
the complexity of a company. However BIO believes by removing all objective 
measmes established in the proposals, AS/5 has seen an “about-face” from the positive 
aspects the small business section of the proposal brou^t to the table. 

As stated in our February 2007 comment letter, BIO believes that both the SEC and 
PCAOB should recopiize product revenue as an important indicator of complexity in its 
own light. Rather than limiting auditor judgment by linking various attributes of smaller 
companies such as market capitalization and overall revenue, both agencies should be 
looking for ways to provide the indicia to auditors that operate both in conjunction and 
independently as proxies for complexity. 

For these reasons, BIO does not see the real relief that our members need to support such 
an overarching rule. 

More Consistent Definitions 

At its April 4*, 2007 open meeting, the SEC authorized its staff to engage the PCAOB to 
improve the consistency of definitions in the 404 rules issued by both agencies. A 
multiplicity of standards and definitions that differ from those commonly employed in the 
area of financial reports themselves has contributed to the burdens associated with 
implementation of section 404. 

BIO member companies had raised concerns that after changing auditors, they 
experienced new interpretations of “material weakness”. Even within the context of a 
principles-based approach to auditing, some further clarification on this guidance was 
needed. We believe the clarification in the PCAOB adopted rule should accomplish this 
and laud the PCAOB for doing so. 

BIO also commends the PCAOB for recognizing that its earlier standard - that an internal 
control deficiency had more than a “remote likelihood” of causing a misstatement was 
vague, confusing and resulted in unnecessary costs and audit burdens. BIO is pleased that 
both the SEC and PCAOB have adopted the same definitions of “materiality”, 

“significant deficiency” and “material weakness”. 

Use of the Work of Others in an Intemated Audit 

In our February 2007 comment letter, BIO urged the SEC and PCAOB to include in any 
reform of Section 404, that auditors be required to use the work of others such as 
management monitoring and testing that is done in accordance with SEC guidance. 
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BIO supports the PCAOB’s work in agreeing to the use of one standard in evaluating the 
use of others work and by adopting a rule that allows auditors to use the work of others in 
the audit of internal controls over financial reporting as well as the integrated audit of 
financial statements. In addition, the PCAOB made progress in adopting a rule that 
allows for recognition of work of internal auditors, company personnel (other than 
internal auditors) and third parties working under the direction of management or the 
audit committee. 

BIO does, however, remain concerned that the burden of determining the competency 
and objectivity of others work is placed solely on the shoulders of the auditor and leaves 
a great deal of subjective evaluation by the auditor in determining the competency and 
objectivity of others work. BIO believes that given the nature and structure of accounting 
firms, there remains no clear incentive for the auditor to recognize the work of others in 
conducting their audit of internal controls.. 


Use of Economic Cost-Benefit Studies 

Lastly, BIO strongly believes that a rigorous economic study of the costs and benefits 
associated with implementation of Section 404 is imperative to understanding if the 
current reform proposals are meeting their objectives. 

BIO would note here that the cost-benefit studies contained in the SEC proposal - and 
not even required in the PCAOB proposal - is wholly qualitative and lacks a quantitative 
analysis. Both agencies should be willing to engage in a true economic analysis of the 
cost and benefits associated with these proposals. Given the variety of other statutory 
requirements that both corporate management and outside auditors must comply with that 
pertain to the integrity of internal controls on financial reporting.'” We commend SEC 
Commissioner Atkins in his questioning of the Commission’s economic anal 3 rsis and 
hope that he will continue to highlight this weakness during the Commission’s 
consideration of AS/5. 

Conclusion 


BIO believes that these reforms are a marginal improvement over the current system of 
interna! control audits but would note that the current system is so bad that any change is 
a marginal improvement. It is unclear, though not entirely likely, that these reforms will 
fully match the rhetoric surrounding their adoption. However, we remain hopeful that 


Section 13(b)(2)(B) of the Exchange Act requires, as it has since 1977, that public companies maintain a 
system of internal controls that provide reasonable assurances as to the accuracy of financial reports. This 
framework provides additional assurance to investors in a cost effective and risk based way to providing 
Section 404 relief for smaller public companies. Under SOX Section 302, each CEO and CFO must certify 
that the financial statements fairly present in all material respects the financial condition of the company, 
and they have disclosed all weaknesses in the internal controls which could be reasonably likely to 
adversely affect the company’s ability to record, process, summarize and report financial information, 
among other items. 
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this is just the first of several steps both the PCAOB and the SEC will take to continue 
refining their rules and reducing the unnecessary burdens placed on America’s emerging 
and innovative companies. In conjunction with their further improvement of the 
PCAOB ’s rule, we urge the SEC to provide an additional exception for non-accelerated 
filers. 

The evidence appears clear as to the consequences of allowing the process to stall here: 
innovation may be stifled and U.S. competitiveness compromised. The stakes for getting 
this right could not be higher; BIO believes that both agencies have taken important steps 
to get on the right track - and now the final adoption of reform lies in the hands of the 
Commission which has the ability to make the much needed changes mentioned in our 
testimony today. Nevertheless, good intentions only go so far. Consistent oversight into 
the application of these new rules and consequent appreciation of how they are 
continuing to impact capital formation particularly for small companies will be critical to 
restoring the U.S. to its proper primacy in the global capital markets. 

Thank you for your time and consideration of BIO’s views. I would be happy to answer 
questions that the Committee may have 
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Chairwoman Velazquez, Ranking member Chabot, and Members of the Committee, I am Diane 
Casey-Landry, President and CEO of America’s Community Bankers* (ACB). I am pleased to 
appear before you today to present our views on Section 404 of the Sarbanes-Oxley Act of 2002 
(“Sarbanes-Oxley”) and the compliance costs for small companies in the wake of recently 
approved standards by the Securities and Exchange Commission (SEC) and the Public Company 
Accounting and Oversight Board (“PCAOB”). ACB is a national trade association representing 
the nation's community banks of all charter types and sizes, including state and federally 
chartered savings institutions and commercial banks. ACB members pursue progressive, 
entrepreneurial and service-oriented strategies in providing financial services to benefit their 
customers and communities. Our members represent $1.7 trillion in assets across the nation and 
are both stock and mutually owned. 

From the outset I would like to thank the Committee for your steadfast advocacy on behalf of 
small companies and for your efforts to provide relief from the burdens they encounter with 
Section 404 of Sarbanes-Oxley. ACB supports the regulatory relief provision in H.R. 1869, 
which would relieve community banks with up to $1 billion in assets from the costly internal 
control attestation and audit requirements of Sarbanes-Oxley. We also support H.R. 1508, 
introduced in the House Financial Services Committee by Representatives Greg Meeks (D-NY) 
and Tom Feeney (R-FL), which would create an exemption from Section 404 based on company 
size. Both of these measures take practical steps to clarify the intent and purpose of internal 
control assessments established in Sarbanes-Oxley. 

' America’s Community Bankers is the national trade association committed to shaping the future of banking by 
being the innovative industry leader strengthening the competitive position of community banks. To learn more 
about ACB, visit www.ACB.us . 
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ACB would also like to commend SEC Chairman Christopher Cox and PCAOB Chairman Mark 
Olson for the recent action taken by their respective agencies to address the burdens of Section 
404 compliance for small companies. The recent interpretive guidance on internal controls 
approved by the SEC and new auditing standards approved by the PCAOB bring a principles- 
based approach to the evaluation and assessment of financial reporting and are important 
achievements that will address many of the burdens that have resulted from Section 404. 
Although it is too early to tell whether, or to what extent, the new rules will reduce the 
compliance costs for small public companies, we appreciate the initiative and leadership 
Chairmen Cox and Olson have demonstrated. While we had hoped for some additional 
flexibility, particularly in the area of the implementation deadline for non-accelerated filers, the 
SEC and PCAOB are headed in the right direction, and we look forward to working with them as 
they continue to identify a middle-ground solution to this complex issue. 

Background 

Sarbanes-Oxley was a well-intentioned law that was passed to strengthen public company 
corporate governance and financial disclosure in an effort to restore investor confidence in the 
public markets. We fully support adequate safeguards to protect the financial safety and 
soundness for all banks, both public and private . However, ACB has long been concerned that 
the unintended consequences of Section 404 requirements impose costs and other burdens on 
public companies of all sizes, without commensurate benefits to investors. This is particularly 
true with respect to smaller public companies. Moreover, community banks are part of a highly 
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regulated industry subject to alternative requirements, heightening the need for relief from the 
unnecessaiy and duplicative burdens they face. 

Publicly held community banks are unique to all other public companies. Community banks are 
part of a highly regulated industry governed by numerous statutes and regulations covering 
almost every aspect of banking activity. Banks are subject to statutory and regulatory capital 
requirements, and each banking institution is regulated by two agencies: the agency that issued 
the bank’s charter and the Federal Deposit Insurance Corporation (“FDIC”). In addition to 
banking laws and regulations, publicly traded banks also must comply with the SEC’s 
recordkeeping and reporting requirements. No other publicly traded company is subject to the 
same scrutiny as a publicly traded bank. 

Financial Disclosure and Governance for Banks 

Even before Sarbanes-Oxley was signed into law, banks had 1 1 years of experience following a 

similar regulations designed to protect their safety and soundness. In fact, these regulations 

served as the initial model for Section 404. Consequently, upon enactment of Sarbanes-Oxley 

and the SEC’s rules implementing Section 404, batiks were faced with an additional burden of 

costs and a second layer of internal controls/financial reporting (“ICFR”). Section 36 of the 

Federal Deposit Insurance Corporation Improvement Act (FDICIA) of 1991^ and Part 363^ of 

the FDIC’s regulations govern bank management’s responsibility for financial statements and 

ICFR. Section 36 requires all banks to have annual financial statements prepared in accordance 

with generally accepted accounting principles (GAAP) and audited by an independent public 

M2U.S.C. § ISSlm 
’ 12C.F.R.Part363 
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accountant. The section also requires each bank to prepare annual management reports signed 
by the chief executive officer and the chief accounting or chief financial officer that contain a 
statement of management’s responsibilities for 1) preparing the bank’s annual financial 
statements; and 2) establishing and maintaining an adequate control structure and procedures for 
financial reporting, and for compliance with safety and soundness regulations. Bank 
management’s report is required to be included in the annual report the bank files with the FDIC 
and its primary federal regulator. These annual reports are available to the public 

For banks with over $ 1 billion in assets, these regulations also require the management to assess 
the effectiveness of its internal controls. In addition, for banks with over S 1 billion in assets, the 
bank’s independent public accountant must examine, attest to, and report separately on 
management’s assertion concerning internal controls. The attestation report is also required to be 
included in the armual report the bank files with the FDIC or its primary regulator. The FDIC 
concluded that these thresholds would be consistent with the underlying statutory objectives of 
Section 36 of FDICIA, and ACB has consistently argued that similar thresholds should be 
sufficient for compliance under Section 404 of Sarbanes-Oxley. 

Section 404 Compliance for Non-accelerated Filers 

As stated earlier, ACB supports the efforts of the SEC and the PCAOB to improve the 
implementation of Section 404 of Sarbanes-Oxley, and we applaud the SEC for its recent 
Management’s Guidance and the PCAOB for its revised auditing standard for internal control 
over financial reporting. However, we are disappointed that in approving the Management 
Guidance, the SEC decided against a further extension of the compliance dates for non- 
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accelerated filers despite requests for a delay from both this Committee as well as the Senate 
Committee on Small Business, Because of the new Management’s Guidance and the significant 
revisions that were made to the auditing standard, ACB strongly believes that the Commission 
should further delay compliance with Section 404 for non-accelerated filers for a minimum of 
one year from the current deadlines. 

Accelerated filers have had three years of experience with the implementation process and they 
are best able to incorporate the changes brought about by the Management’s Guidance and the 
revised auditing standard. ACB’s members that are non-accelerated filers are very much 
concerned with the cost and burdens of compliance. These smaller companies are acutely aware 
of the struggle accelerated filers underwent to implement Section 404, even though these larger 
companies have significantly more resources and economies of scale. Non-accelerated filers are 
the companies that can least afford to add personnel, consultants, and systems to comply with 
Section 404, This is particularly true if the Commission’s proposed Management Guidance and 
the PCAOB’s revised auditing standard prove unsuccessful in reducing the costs and other 
burdens associated with implementing Section 404. ACB appreciates the Chairwoman and 
Ranking Member’s March 12, 2007 letter to SEC Chairman Cox voicing these same concerns, 
and with the filing deadline just 6 months away, we remain hopeful that additional consideration 
will be given to this important issue. 

The Impact on National and Global Competitiveness 
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A broader and more deleterious consequence created by Section 404 is the attack on our nation’s 
ability to compete. Strong financial markets are crucial to the health our nation’s economy, and 
while ours are by far the strongest with regard to transparency and accountability, these 
safeguards are inadvertently creating a competitive marketplace advantage for Asia, the United 
Kingdom, and other markets in the European Union where regulatory scrutiny is far less severe 
and the legal system is not fraught with the same abuse and activism. Sarbanes-Oxley was 
created to increase waning investor confidence, and to create a more robust environment for 
foreign investment. But navigating the complexity of the United States’ patchwork of regulatory 
burdens and fear of an increasingly frivolous litigious enviromnent is driving more and more 
public companies — and potential investors - overseas to seek regulatory shelter in a more 
streamlined environment. The situation is particularly grim from the standpoint of small 
companies. Generally, companies go public in order to raise capital through public markets. 
However, the Section 404 compliance costs have caused many companies to either remain or 
consider going private because the costs associated with being a public company outweigh the 
benefits. 

Competitiveness concerns have an impact on our domestic economy as well. At a time when the 
outsourcing of jobs overseas is becoming more and more common among large corporations, 
small companies such as community banks continue to be job incubators on main street America. 
However, mergers and acquisitions involving community banks are typically motivated by real 
market pressures, including regulatory burden and unfair competition that is constricting 
community banks. For example, as of June 1, America’s Community Bankers’ NASDAQ index 
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(“ACBQ”)"’, is comprised of 517 banking companies with a combined market capitalization of 
$193 billion. At inception in December 2003, there were 542 companies with a market 
capitalization of $170 billion. Each year approximately 50 companies leave the index, primarily 
because of mergers, but also because of delistings. ACB estimates that as many as 20 percent of 
ACBQ’s departures are because of a decision to delist, triggered primarily by efforts to reduce 
the burden created by Sarbanes-Oxley. Additionally, some of the mergers listed Sarbanes-Oxley 
burden as a contributing factor for the decision to merge, since Sarbanes-Oxley costs are 
proportionally higher for smaller companies. This does not take into account the missed 
opportunities for ACBQ since 2003, since the atmosphere for raising capital in the U.S. has 
gotten increasingly worse, particularly with regard to the cost of going public and the costs 
associated with compliance for a small public company in the United States. 

We urge the SEC to update the Exchange Act’s threshold for registration as a public company 
from the 500 shareholder level first imposed in 1964. The threshold should be moved to a much 
higher range in order to provide much-needed regulatory relief for smaller companies that 
choose to be public, but chose not to be listed on an exchange. 

The policies embodied in Sarbanes-Oxley Section 404 have a trickle-down affect into the local 
economies as well, since community banks that decide to sell or merge with larger regional and 
national banking organizations will no longer have the presence in local communities beyond 
their branch offices. We all must work together to ensure that our community banks remain 

The America Community Bankers NASDAQ Index is the most broadly representative stock index for community 
banks. ACiB and the NASDAQ Stock Market launched this index in December 2003 to track the performance of the 
strong community-based banking sector. 
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community banks. Our customers - your constituents - have come to depend on their local 
community banking institution to provide the best possible service. This comes from years of 
relationship-building and from living and woridng in the same communities. Part of achieving 
this goal is to reduce the amount of unnecessary regulatory burden that is hampering the ability 
of community banks to compete domestically. 

Conclusion 

On behalf of ACB and its member banks across the nation, thank you again for the opportunity 
to appear before you today. We appreciate the work this Committee is doing to ensure that small 
businesses continue to be engines of economic growth in the United States, and to mitigate some 
of the unnecessary and burdensome compliance requirements stemming from Section 404 of 
Sarbanes-Oxley. I would be pleased to answer any questions you may have. 
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Chairwoman Velazquez, Ranking Member Chabot, and Members of the Committee. 
Thank you for giving me the opportunity to testify on this important issue on behalf of the 
Committee on Capital Markets Regulation (“CCMR”). 

The CCMR is independent and bipartisan, composed of twenty-three corporate and 
financial leaders drawn from the investor community, business, finance, law, accounting, and 
academia. The CCMR issued its Interim Report on the state of the U.S. public equity capital 
markets on November 30, 2006. The CCMR’s purpose is to explore a range of issues related to 
maintaining and improving the competitiveness of U.S. capital markets. 

The question posed by this Committee — will the new standards of the SEC and PCAOB 
lower Sarbanes-Oxley (“SOX”) 404 compliance costs for small public companies — is crucial to 
the well-being of Main Street, the bedrock of the U.S. economy. The answer to your question 
about compliance cost reduction is simply that we do not know. Unfortunately, neither the 
PCAOB nor the SEC, at least based on what has been publicly released, has done any 
quantitative analysis of the cost reductions they expect to achieve through their new standards. 
Nor have they indicated that they would do field tests to determine achievable cost reduction 
before applying these revised standards to small companies. 

My own guess is that costs will come down but only moderately because, even after a 
lengthy deliberative process, the agencies have failed to give enough precise guidance as to what 
internal controls management and auditors should look at — that is, what is “material.” We 
should not, however be operating on guesses. Before we move full speed ahead on applying 
Section 404 to small companies we should have a much better idea of what the cost reduction 
will actually be. 

As stated in our Interim Report, the CCMR believes that maximizing the competitiveness 
of U.S. capital markets is critical to ensuring economic growth, job creation, low cost of capital, 
innovation, entrepreneurship, and a strong tax base. The issue of the competitiveness of our 
capital markets is essentially an issue for Main Street, not Wall Street. Wall Street can move to 
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London, Main Street cannot. Indeed, Bloomberg news recently reported that so far this year 
investment banks have earned $ 1 . 1 billion in fees from European initial public offerings 
(“IPOs”), compared with only $1.4 billion from U.S. IPOs. In 2002, investment banks earned 
five times as much taking companies public in the United States as they did in Europe. 

Our market is becoming less attractive to foreign companies. In the late 1990s, the U.S. 
exchange-listed capital markets were attracting forty-eight percent of the value of all global IPOs 
(where a company raises funds outside its home country). By 2006, the share of U.S. exchanges 
had fallen to 7.2 percent. Our market is also becoming unattractive to U.S. companies. In 2000, 
every IPO by a U.S. company took place in the United States; in 2006, 17 percent of the funds 
raised by U.S. companies in IPOs were raised abroad. And this is despite the fact that a U.S. 
company doing a public offering abroad is restricted from selling its stock to U.S. residents for a 
year. Both U.S. and foreign companies find the U.S. private market (that is, the Rule 144A 
market which is restricted to large instimtions) more attractive than the public market. Straight 
public equity offerings on the three largest U.S. stock exchanges raised SI 54 billion last year, 
while 144A offerings raised $162 billion. 

Our report also documents the tremendous growth in private equity capital and going- 
private transactions. One of the reasons for the increasing attractiveness of private equity 
markets is concern over the costs of going or remaining public. Between 2001-2006, the number 
of venture capital (“VC”) backed acquisition exits with disclosed values has exceeded the 
number of VC-backed IPO exits by more than ten-to-one (1919 to 171), with a difference of 
value of $95 billion as compared to $12 billion (albeit that this comparison should be adjusted 
for the fact that IPO exits, unlike private exits, typically involve the sale of only a portion of the 
company). 

Our Committee believes that the U.S. public markets are clearly becoming less attractive 
to companies, both foreign and domestic. While there are many factors responsible for this 
development, including better foreign markets and more capital available abroad, our 
Committee, as well as other studies, has concluded that the cost of U.S. regulation, as well as the 
prospect of class action lawsuits, has played a significant role. And one of the significant costs 
of regulation is the cost of SOX 404. 

Our Committee believes that Section 404 has provided significant benefits to both 
investors and businesses by increasing the reliability of financial statements, strengthening 
internal controls, improving the efficiency of business operations, and helping to reduce the risk 
of fraud. The CCMR strongly supports the need for effective internal controls. However, the 
CCMR also believes that this objective can be achieved at a much lower overall cost than the 
average $OX implementation cost per company of $4.4 million in the first year, and $3.8 million 
and $2.9 million in the subsequent two years, as reported by Financial Executives International 
(FEI). Despite the reduction of costs, 78% of the 200 executives surveyed by FEI said the costs 
of SOX 404 still outweigh the benefits. 

These cost estimates are only for direct costs, and ignore important indirect costs such as 
diversion of scarce management resources and time and the increased risk aversion of companies 
and boards. The burden for smaller companies is obviously greater than for larger companies 
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since costs are not generally proportionate to size. The costs under the present regime, 
particularly for small companies, remain very substantial. 

Small companies that are already public may not be able to absorb such costs or remain 
solvent, let alone competitive. Indeed, they may be forced to exit the public markets to avoid 
such costs. More importantly, small companies in the future may find themselves starved for 
venture capital, and this could have a profound effect on the U.S. economy. Venture capitalists 
seek to exit their investments by going public — the dream of every start-up. According to the 
National Venture Capital Association, in 2006, venture-backed companies accounted for 10.4 
million U.S. jobs or approximately 9 percent of total private sector employment, and $2.3 trillion 
in U.S. revenues, 17.6 percent of GDP. A majority of these venture-backed companies are now 
public. Less attractive public markets means less investment in small business. 

As I have said, I expect that the new standards will bring down the costs of Section 404, 
but not as much as it could and should. This judgment must to some extent be tentative. While 
the PCAOB’s proposal for a new Auditing Standard, ASS, is public, the SEC has yet to release 
the language of its own new standards, although it did provide some information in its release 
announcing changes (SEC Release 2007-101, May 23, 2007). I will assume the SEC standards 
are basically the same as set forth in its proposal of December 20, 2006 (SEC Release No. 33- 
8762), and consistent with the new proposal of the PCAOB. 

Certain important improvements have been made that were called for by oiu: Committee, 
We strongly support a top-down, risk-based approach that allows auditors and management to 
make use of their judgment in tailoring their evaluations of controls to the individual 
circumstances of the companies they audit, so-called “scalability.” We also support the 
elimination of the requirement for an auditor to examine management’s evaluation process. We 
further support the increased flexibility provided for auditors to rely upon the work of others and 
to limit the testing of low-risk controls. Auditors will be more able to adjust the nature, timing, 
and extent of their procedures based on knowledge obtained during previous audits, particularly 
as such knowledge impacts the auditor’s assessment of risk. We also commend the PCAOB’s 
focus on fraud controls. We applaud the work done by the agencies on these issues. We hope all 
of these measures will bring down costs for companies, including small companies. We just do 
not really know how much. 

We also believe, however, that there are two serious defects in the SEC-PCAOB 
approach; failing to set a precise standard for materiality and deciding to apply the new standards 
to small companies before doing a thorough cost-benefit analysis of how these revised standards 
will affect small companies. 

The question of materiality is at the heart of the SOX 404 problem. Management and 
auditors should only be looking at things that matter. The high costs of Section 404 are in 
significant part due to the fact that there is no clear guidance from either the PCAOB or SEC as 
to what does matter. 

Under current guidance, a material weakness is defined as a significant deficiency, or a 
combination of significant deficiencies, that results in more than a remote likelihood that a 
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material misstatement of the annual or interim financial statements will not be prevented or 
detected. Materiality itself is determined by a broad range of qualitative considerations. 

In the PCAOB’s proposed ASS (p. AT), a material weakness is defined as “a deficiency 
or a combination of deficiencies, in internal control over financial reporting, such that there is a 
‘reasonable possibility’ that a material misstatement of the company’s annua! or interim financial 
statements will not be prevented or detected on a timely basis.” The SEC used the same 
formulation of material weakness in the release announcing adoption of its new standards. 

The change from “more than a remote likelihood” to a “reasonable possibility,” if it is an 
improvement at all, is a minor one. Indeed, the PCAOB itself says in its proposal that “as a 
definitional matter, ‘reasonable possibility’ and ‘more than remote’ describe the same 
threshold. ...” More importantly, while companies and auditors are instructed to look at 
deficiencies which have a “reasonable possibility” of causing a material misstatement, they are 
given only very imprecise guidance as to what controls are material. The PCAOB guidance 
continues to provide a qualitative standard for materiality — the same qualitative standard it now 
uses for financial statements (Proposed A5, A-1, 1[19) — and the SEC appears to take the same 
approach. 

There is no reason to examine internal controls that, even if deficient, could have no 
material impact on the financial statements of the company. Unfortunately, this appears to be 
happening today. As the CCMR’s report shows (Figure V.3, p. 123), an analysis by Mercer 
Oliver Wyman of the 2006 GAO study indicates that between 2002-2005, fifty-three percent of 
restatements, using the same qualitative definition of materiality for internal control and financial 
statement weaknesses, had either a negligible negative (less than one percent) or a positive 
impact on company market value. The market clearly does not think most of these restatements 
involve truly material weaknesses. 

Our Committee has recommended that materiality for internal control reviews should be 
defined consistently with the definition of materiality in financial reporting, as it is today, but 
that both definitions should be more precise. Specifically, the CCMR recommended that 
materiality for scoping an assessment should be defined, as it was traditionally, in terms of a five 
percent pre-tax income threshold. This standard would be consistent with the overall risk-based 
approach advocated by both the SEC and PCAOB. In cases where the five percent test would 
not be meaningful, the agencies should allow companies and their auditors to exercise their 
reasoned judgment in choosing other measiues to evaluate materiality in ways that are relevant to 
investors. We are very concerned that without a presumptive quantitative standard, the costs of 
compliance with Section 404 wilt not be sufficiently reduced. There is no need to look at things 
that do not matter. 

Our second concern is the decision announced by the SEC to apply its new management 
standards to financial statements filed in 2008 to both large and small companies, and the 
decision of the PCAOB to apply its new auditing standards to both types of companies with 
respect to financial statements filed in 2009. The CCMR recommended that the application of 
Section 404 to companies with less than $75 million of market capitalization should continue to 
be deferred until the standards were revised. This has been done. However, we also 
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recommended that after the revision of the standards, the SEC should reassess the costs and 
benefits of extending Section 404 to small companies. This could be done by field testing the 
new standards on large companies, as well as on small companies that voluntarily decided to 
adopt the new standards, and on the smallest of the companies already subject to Section 404, 
those between $75-$100 million in market capitalization. In-depth interviews could also be had 
with a sample of smaller companies and their auditors to assess the potential cost impact. Bear 
in mind that for small companies that have not yet been required to apply Section 404, the issue 
is how much the new standards will bring down first year costs, historically an average of $4.4 
million. 

To the extent that the SEC found that, even with the adopted reforms, the costs were still 
too high relative to the benefits, it should ask Congress to consider exempting small companies 
from the auditor attestation requirement of Section 404 while at the same changing the 
management certification requirement to one requiring reasonable belief in the adequacy of 
internal controls. Without the comfort of auditor attestation, management would not be able to 
make a stronger certification. 

When the SEC implemented SOX 404 in 2003 it did so through a rule-making in which it 
estimated the costs of compliance with Section 404 would be $91,000 per company (SEC 
Release No. 33-8238, June 5, 2003). That estimate was, we now know, off by a factor of over 
48. In reformulating ASS, the PCAOB has done no publicly available analysis of how much 
costs will be reduced by ASS generally, or for small companies. The SEC in its proposed new 
rule changes and guidance (SEC Release No. 33-8762, December 20, 2006), provided only a 
cursory discussion of cost-benefit analysis with no quantitative estimates of cost. 

The National Securities Market Improvements Act of 1996 requires the SEC to consider 
in any rulemaking process "in addition to the protection of investors, whether the action will 
promote efficiency, competition and capital formation." In Chamber of Commerce of the United 
States V. SEC, 412 F.3d 133 (D.C. Cir. 2005), the court struck down the SEC’s proposed rule 
requiring that 75% of a mutual fund board be composed of independent directors and have an 
independent Chairman on the ground that the Commission provided insufficient analysis of the 
costs of its proposal. The court stated that “uncertainty may limit what the Commission can do, 
but if does not excuse the Commission from its statutory obligation to do what it can to apprise 
itself — and hence the public and the Congress — of the economic consequence of a proposed 
regulation before it decides whether to adopt the measure.” Id., at 144. The Sarbanes-Oxley Act 
added an additional requirement for SOX rules, that the SEC “promulgate such rules and 
regulations, as may be necessary or appropriate in the public interest or for the protection of 
investors, and in furtherance of this Act.” 15 U.S.C. §7202(a) (2007). These requirements would 
clearly apply to the rule-making portion of the new SEC standards. While it is less clear that 
such obligations extend to “guidance,” the SEC still should have provided a cost-benefit analysis 
of its guidance as a matter of policy, particularly when the guidance involves the application of 
its own rules. 

These cost-benefit obligations should be complied with ex ante, before the SEC adopts a 
rule, so that whatever analysis is done by the SEC is open to public scmtiny. Unfortunately, this 
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was not done. Further, we have no reason to believe that such analysis has even been done ex 
post, in the rule as adopted. We would hope the SEC would remedy this matter. 

The SEC must still approve the new guidance of the PCAOB. This would appear to 
require an SEC rule-making procedure, with notice and comment. In addition, it may require the 
SEC to do a cost-benefit analysis since the SEC is approving a PCAOB rule. The law on this is 
not clear. However, the right policy is clear. Before allowing this new PCAOB standard to 
become operative, the SEC or the PCAOB should do a cost-benefit analysis with respect to 
PCAOB ’s revisions of its standards. 

Everyone — companies, Congress, and the public — is entitled to know and comment on 
what cost reductions the two agencies expect to achieve consistent with investor protection, since 
this was a major objective of the exercise. We should not proceed on such an important matter 
without a more solid foundation. 

What is the rush? The SEC has already deferred applying its rules to small companies 
four times, first in February 2004, and then in March 2005, September 2005, and December 
2006. We think it would be prudent to continue to do so, until a rigorous cost-benefit analysis 
justifies applying the new rules to small companies. If the costs are still too high, the SEC 
should then turn the problem over to the Congress. 



99 



National VentureCapkal Association 


House Small Business Committee Hearing 
June 5, 2007 

“Sarbanes Oxley Section 404: Will the SEC and PCAOB ’s New Standards 
Lower Compliance Costs for Small Companies” 

Testimony of: 

Mark G. Heesen 
President 

National Venture Capital Association 


Chairwoman Velazquez, Ranking Member Chabot and Members of the Committee, my 
name is Mark Heesen and I am president of the National Venture Capital Association 
(NVCA) which is based in Arlington, Virginia. The NVCA comprises more than 480 
venture capital firms in the United States and advocates for policies and legislation that 
are favorable to entrepreneurship, capital formation and innovation. 

I would like to thank the Committee for the opportunity to contribute to the discussion 
around Sarbanes Oxley reform measures. This has been an area of expressed concern for 
NVCA members and their venture backed entrepreneurs for a significant period of time 
and we are anxious for relief Venture backed companies are a critical component of US 
economic growth. In 2006, companies that got their start with venture capital accounted 
for 10.5 million US jobs and 2.5 trillion dollars in revenues. That equates to 9 percent of 
the US private sector emplo 3 Tnent and 17 percent of US GDP. Companies that were once 
venture backed include Google, Genentech, Starbucks, FedEx, Intel, eBay and Microsoft. 
These companies were once small and privately held - waiting for the opportunity to go 
public. Today the next Microsoft is waiting — but has yet to go public because SOX 
compliance has been too burdensome - and other alternatives are available. 

As you are all aware, our primary concern with the Sarbanes Oxley law is that the cost 
and effort related to Section 404 has hindered the economic development of promising 
venture backed companies in the United States. We have both anecdotal and quantitative 
evidence that many of these companies have been held back from their ultimate goal of 
an initial public offering due to the high cost of 404 compliance and the lack of support 
from the accounting profession. In 2006 there were only 57 venture backed IPO’s on US 
exchanges and 17 IPO’s on foreign exchanges. Twenty three percent of US venture 
backed IPO’s did not occur here in the US. Prior to SOX it was virtually unheard of for a 
US venture-backed company to go public anywhere else but a US exchange. 
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What is more concerning is that we are now seeing companies that have a high enough 
profit run rate to consider an IPO choosing to be acquired instead. They want to rid 
themselves of the SOX burden which currently remains for smaller public companies. 

The result is a long list of companies that should have been stand alone economic 
contributors being absorbed into larger entities. Rather than an IPO on a US exchange 
being the ultimate achievement for a venture backed company, it has now become, at 
best, one of many options to be considered and, at worst, an outcome that is actually 
avoided. Imagine if Google had been acquired by Microsoft, or Dell acquired by 
Compaq, or Genentech acquired by J&J. Perhaps the innovation would have survived 
but the market value, jobs and revenues would have been diluted substantially. 

It has been more than two years since the first recognition that the SOX Section 404 is 
harmful to small companies. We commend the SEC for its recognition of the problems 
and its effort to enact solutions. Yet, while focusing on a “top-down, risk-based 
approach” is well intentioned, the question ultimately has to be “will small companies 
finally see relief?” Based on preliminary reviews of the of the SEC and PCAOB 
proposals, our answer is “no”. We do not believe the combined guidance put forth goes 
far enough to effect the necessary changes to relieve the SOX burden for smaller 
companies. 

Although we are still reviewing both sets of documents, it is particularly troubling that 
the PCAOB in its release (page 5) states that “the Board believes that the changes made 
to the proposal reflect refinements, rather than significant shifts in approach.” NVCA 
and its members do not believe that refinements will result in a reduction of the 
overwhelming costs faced by small companies. Refinements will not stop the drain on 
company resources that is threatening the continued leadership of the US capital markets. 

Our concern is centered primarily on the intentions and behavior of the accounting 
profession. The recent proposals place too much power in the hands of the auditors that, 
in the face of both economic and liability concerns, are under tremendous pressure to take 
the most conservative and expensive auditing path. If the SEC wishes to enact reform 
measures that are meaningful, the Commission must exercise more strongly their 
jurisdiction over the PCAOB to insure that improvements will be significant enough to be 
material and will be carried out in the spirit in which they were intended. 

The venture capital industry believes that three drivers are critical in this regard: First, 
we are gravely concerned that the accounting profession will not change its high cost 
practices and the recent guidance provided by both the SEC and the PCAOB regarding 
materiality is not specific enough to compel them to do so. Second, the oligopoly that 
exists for 404 audits leaves no choice for small companies in terms of service providers. 

It does provide any incentive for the Big 4 to lower costs. Lastly, because of these first 
two concerns, it is imperative that prior to adoption, all proposed measures are fully field 
tested to confirm that they will indeed reduce costs. 
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Raising the Materiality Threshold 

One area of guidance where we have significant and immediate concern is the 
determination of what is and what is not “material” to sound financial reporting. The 
original SOX language set the probability threshold extremely low. Any area in which 
there was “more than a remote likelihood” for an error to result in a material mistake on 
the financials was required to be examined, documented, and reported on to the 
company’s audit committee. This language comprised just about everything. The 
proposals put forth by both the SEC and PCAOB suggest changing the language to 
“reasonable possibility”. We feel this general statement does nothing to distinguish itself 
from the original language, leaves everything open to interpretation, and will do little to 
reduce costs. 

Chairman Cox has stated throughout the reform considerations over the last year that 
auditors and companies need to be focusing on the few key items that are really important 
and pose the most risk. Yet, the standard of materiality as revised will allow the 
accounting profession to continue to sweep in whatever areas they choose. Although in 
general we support the move to enact "principles based" guidance, we feel there should 
be an objective threshold if we are going to properly balance risk and cost. 

Accounting Profession Reform 

Since SOX was enacted in 2002, the relationship between the Big 4 accounting firms and 
venture backed companies has become increasingly problematic. Many of our small 
companies have lost the attention of their auditors as these Big 4 firms are favoring larger 
public companies who offer lucrative 404 auditing engagements. Those who do maintain 
their Big 4 relationships do so at a 404 cost that averages close to $1 million annually. 

As Sarbanes Oxley allows only for accredited accounting firms to complete 404 audits, 
our companies are held hostage to this oligopoly which is becoming increasingly 
untenable fi'om both a cost and management standpoint. 

We would not have these large concerns if we had any comfort level that the Big 4 
accounting firms actually support SOX reform. But their actions in the field and on 
reform commissions suggest otherwise. In the last two years, the accounting profession 
led by the Big 4 has resisted SOX reform while reaping the benefits of lucrative 404 audit 
engagements. Further, they have publicly warned that the supporters of reform 
“shouldn’t expect a dramatic reduction in costs” with the adoption of proposals. This is 
not only the publicly stated view of the Big 4 firms but, anecdotally, the specific message 
delivered to many of our members’ portfolio companies in recent months. As our 
companies have entered the planning and fee-setting stages for their 2007 audits with the 
draft SOX reform proposals available, they are already being told that their auditors don’t 
expect much, if any, savings in audit fees from the proposals as written. The Big 4 firms 
are advising our companies that they may have some benefits internally but the level of 
work the firms will have to perform to complete the internal controls attestation will be 
unchanged. 
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Just like smaller public companies, our private venture backed companies - the next 
Microsofts to which I earlier referred — are also at the mercy of the Big 4. While one 
would believe that because these companies are private, they can engage a second tier 
accounting firm, in reality this is not a viable solution. Investment banks that ultimately 
take these companies public - or sell them to strategic buyers - require a Big 4 audit as a 
sign of a clean bill of health. Switching from a second tier firm to a Big 4 firm when the 
company approaches an IPO is impractical, not only because of the cost and time of 
reauditing the financials - which every new auditing firm requires in this situation - but 
also because in today’s culture doing so wrongly implies to the market that the company 
must have something to hide. A company can switch to any other service provider as 
best fits its needs - lawyers, IT providers, banks. But they cannot switch accounting 
firms if they hope to go public. Our small companies are paying these large bills because 
there is no competition. We need to create a system where companies have quality 
choices outside of four large providers. 

If the profession has no intention of being part of the cost lowering solution, US 
companies of all sizes should have the option to seek alternative service providers. The 
SEC should allow and Congress should publicly support the ability of accredited 
accounting professionals beyond the Big 4 to perform 404 attestations. By doing so, the 
SEC will create a healthy, competitive ecosystem where the market will set the right 
price for services rendered. 

The Big 4 have a choice now to truly embrace cost reducing measures. If they continue 
to choose poorly, small companies should have the choice to find reasonable alternative 
providers. 

Field Testing Prior to Adoption 

Despite what we would consider an urgent need for reform, we will ask today that the 
SEC move forward cautiously when formalizing the proposed guidance. We can attest 
as builders of new enterprises that while the plans often look solid on paper, 
implementation is another story. It is worth taking that added time to ensure that reform 
recommendations are positioned for success. 

Blindly adopting recommendations without field testing them first would be akin to 
purchasing a company without going through due diligence. Field testing ensures that 1) 
the recommendations tvill indeed reduce cost 2) all the players including the accounting 
profession are operating in the spirit of reform and 3) there are no unintended 
consequences. Understanding how the reform measures work in the real world before 
officially adopting them will allow the SEC to make adjustments as necessary without 
having to re-open a new process. Small companies have already had more than their 
share of unintended consequences as it relates to Sarbanes Oxley. Let’s be sure to get it 
right “ and prove that reform works - before declaring victory. We are willing to work 
with the SEC in this process. 
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Conclusion 


It has been more than two years since the first public recognition that SOX costs were 
problematic. The worthy recommendations made by the SEC Advisory Committee on 
Smaller Public Companies after a comprehensive 13 month effort were largely dismissed. 
Since that time a Chamber of Commerce Committee, the Hal Scott Committee and others 
have spent time confirming the problem, but solutions have remained elusive. 

We are at a critical inflection point and it has taken us a long time to get here. The good 
work of all involved will be for naught if the accounting profession does not get on board 
with cost reduction - or if implementation of the proposals fails. There are means by 
which we can mitigate these serious risks to reform. But the SEC must be deliberate and 
strong in their resolve. Taking the time to field test and placing the needed pressure on 
the Big 4 to join the effort is required. We have waited too long for this reform to take 
place - but we are willing to wait longer to make sure we get it right. 

Thank you. 



104 



Statement 
of the 

U.S. Chamber 
of Commerce 


ON: GETTING IMPLEMENTATION RIGHT: SARBANES-OXLEY 

SECTION 404 AND SMALL BUSINESS 

TO: HOUSE SMALL BUSINESS COMMITTEE 

BY: DAVID T. HIRSCHMANN, SENIOR VICE PRESIDENT, U.S. 

CHAMBER OF COMMERCE AND PRESIDENT, U.S. CHAMBER 
CENTER FOR CAPITAL MARKETS COMPETITIVENESS 

DATE: JUNE 5, 2007 


The Ciiairiber'.s iiii.ssion is to advance human progress ihrougit an economic, 
political and social vSy.stcoi based on individual freedom, 
inccihive, initiative, opiwrtunity and responsibility. 




105 


Testimony before the House Small Business Committee 

"Getting Implementation Right: Sarbanes-Oxley Section 404 and Small Business" 

Testimony by David T. Hlrschmann 
Senior Vice President, U.S. Chamber of Commerce and 
President, U.S. Chamber Center for Capital Markets Competitiveness 

June 5, 2007 


Good afternoon, Chainvoman Velazquez, Ranking Member Chabot, and members of the 
committee. My name is David Hirschmann and I am Senior Vice President of the U.S. Chamber 
of Commerce (the “Chamber”) and President of its newly formed Center for Capital Markets 
Competitiveness (the “CCMC”). The U.S. Chamber of Commerce is the world’s largest 
business federation, representing more than three million businesses and organizations of every 
size, sector, and region. 


Introduction 

I’m here today to discuss the impact of Sarbanes-Oxley (“SOX”) Section 404 on small 
public companies as well as those seeking to access the capital markets. I will address four 
points in my testimony: 

First, the Chamber would like to thank the chairwoman and the committee for holding 
this hearing and focusing on this important issue. We also welcome the recent initiative by the 
Securities and Exchange Commission (“SEC”) and the Public Company Accounting Oversight 
Board (“PCAOB”) to fix the implementation process of Section 404 to better reflect the intent of 
Congress and the needs of investors and companies. We view the PCAOB’s new auditing 
standard as well as the SEC’s guidance for companies as a significant step forward. We would 
like to commend Chairman Cox and Chairman Olson for their leadership, time, and energy to 
bring balance to the system. 

Second, we believe that we will only know if these efforts have been successful after we 
see how they are implemented by auditors and companies and enforced by the PCAOB. 

Third, until we have a ftill-year of experience with the new rules, we believe it would be 
a mistake to extend their application to smaller public companies. 

Fourth, we urge Congress, the SEC, and other regulators to work together to address the 
additional critical issues that are making it harder and harder for leaders of smaller companies to 
access the public capital markets in order to grow their businesses and create jobs. 
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Background 

More than 96 percent of the Chamber’s members are small businesses with 100 or fewer 
employees, 70 percent of which have 10 or fewer employees. Yet, virtually all of the nation’s 
largest companies are also active members. Besides representing a cross-section of the 
American business community in terms of number of employees, the Chamber represents a wide 
management spectrum by type of business and location. Each major classification of American 
business - manufacturing, retailing, services, construction, wholesaling, and finance - is 
represented. Furthermore, the Chamber has substantial membership in all 50 states. 

The Chamber has strongly supported many of the reforms in Sarbanes-Oxley, including 
ensuring that boards are more active, independent, and composed of members with significant 
financial and other expertise. In particular, we believe that having elfective and independent 
audit committees provides important oversight over the work of internal and external 
accountants. Effective internal controls are an essential part of good financial governance at all 
companies. 

However, the implementation of Section 404 has led to costs and regulatory burdens far 
beyond what Congress intended and well in excess of the benefits to shareholders and 
management. This is amplified among smaller public companies due to economies of scale. 
Companies feel they are getting less effective advice and support from their external auditors, 
and auditors are increasingly being second-guessed by their new regulator and the trial bar. 

The result is predictable: Companies increasingly feel that that the costs of being a public 
company outweigh the benefits, and an important tool companies have used to access capital is 
being eroded. 

I know access to capital and the capital formation process is of particular interest to this 
committee. Small business drives much of the economic activity, innovation, and job creation in 
the United States. Over the last decade, for example, small businesses have generated 60 to 80 
percent of net new jobs.’ These businesses made up 97 percent of exporters and produced 28 
percent of the known export value in FY 2005.^ Small businesses employ 41 percent of high- 
tech workers and produce 13 to 14 times more patents per employee than large patenting 
businesses.^ 

For well over a century, this has been the greatest country on Earth for entrepreneurs and 
innovators to access low-cost capital to start and expand a business. Transparent and liquid 
public markets have been a key part of this. Without these markets, small firms can’t get the 
venture capital or bank loans they need to buy new equipment, hire staff, or develop and market 
their products. Venture capital firms need a clear way get back their investment at a fair 
price. This usually means taking a company public. If the costs of becoming a public company 
are unnecessarily increased, then some companies will not get the venture capital they need, 
resulting in less innovation and competition within the marketplace. Banks also depend on the 


‘ Small Business Administration Web site, httD://aPDl.sba.gov/faos/faaindex.cfm?areaiD=24 . 
^Id. 

’Id. 
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capital markets to securitize the loans they make to small companies, which allows for greater 
lending to small businesses. 

Statistical evidence indicates that regulatory changes resulting from implementation of 
Section 404 of SOX have had a disproportionate impact on the cost of capital for smaller 
businesses that have already had to comply. For example, a $1 million to $2 million compliance 
price tag is an enormous burden on a company that has $3 million in net income."* A study 
released by the GAO in April 2006 stated that public companies with market capitalization of 
$75 million or less paid a median of $1.14 in audit fees for every $100 in revenues. This 
compares to $0.13 in audit fees for public companies with market capitalization greater than $1 
billion.^ 

Fortunately, the costs associated with small business capital formation have come to the 
forefront of the agenda for financial markets’ regulators. The SEC and PCAOB have made a 
good-faith attempt at providing scalable rules and guidance to smaller companies. The question 
now is will it be implemented as intended? 


Correcting the Implementation of Section 404 of Sarbanes-Oxley 

The Chamber has been strongly supportive of most provisions of SOX and believes that 
SOX has had positive effects in causing boards, management, and external auditors to be more 
thorough and attentive in fulfilling their responsibilities. 

The problem has been, as almost everyone agrees, the failed implementation of Section 
404. The 168 words that comprise Section 404, as well as the accompanying Auditing Standard 
2 (“AS2”), have created regulation that produces costs far in excess of benefits, particularly for 
small companies. As Chairman Cox has noted, “Congress never intended that the 404 process 
should become inflexible, burdensome, and wasteful. The objective of Section 404 is to provide 
meaningful disclosure to investors about the effectiveness of a company’s internal controls 
systems, without creating unnecessary compliance burdens or wasting shareholder resources.” 

U.S. Chamber members have frequently expressed concern that the implementation of 
Section 404 has had a negative effect on the competitiveness of U.S. companies and the U.S. 
capital markets, and created burdens on companies and their management well beyond what 
Congress intended. While Section 404 was fundamentally conceived as a disclosure requirement 
to provide more information about internal controls, under AS2 it has evolved into a substantive 
requirement for specific levels of internal controls that goes far beyond the Congressional 
mandate. 


“ Comment by Clay Corbus, Town Hall Meeting, Commission on the Regulation ofU.S. Capital Markets in the 21st 
Century, San Francisco, October 12, 2006. 

^ U.S. Government Accountability Office, Report to the Committee on Small Business and Entrepreneurship, U.S. 
Senate, Sarbanes-Oxley Act: Consideration of Key Principles Needed in Addressing Implementation for Smaller 
Public Companies, at 1 7. (April 2006) (GAO Report) available at; http ://www. gao.gov/new.items/d06361.ndf . 
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When the SEC and PCAOB issued proposed revisions in December 2006, the Chamber 
voiced a number of concerns (see comment letter available at: http://www.sec. eov/comments/s7- 
24-06/s72406-2 1 3 .pdf) . Key recommendations included: ensuring a reasonable cost-benefit 
balance; performing a cost-benefit analysis after the rules are adopted; aligning SEC 
management guidance with ASS; clarifying terms such as material weakness, significant 
deficiency, and materiality; clarifying Auditing Standard 3; aligning Auditing Standard 4 with 
ASS; ensuring that the rules are both risk-based and scalable; providing more certainty regarding 
the proposed safe harbor; educating the public about the role and scope of an audit and that a 
restatement does not necessarily indicate a material weakness; allowing for greater use of the 
work of others; providing specific guidance on IT systems and controls; and promulgating 
additional guidance on footnote disclosure controls. The Chamber also raised serious concerns 
about the extent to which the new standards will improve “on the ground” implementation. 

It remains to be seen if all these problems have been addressed, and we encourage the 
SEC to issue its management guidance for public review as soon as possible. We also urge the 
PCAOB to update the inspections process to ensure that it is consistent with the new rules put 
forth. 


A Delay for Smaller Companies 

The Chamber has called for a further delay in compliance with Section 404 for smaller 
public companies until the new rules and guidance have been fully tested by larger companies. 
Note that only companies with a market capitalization greater than $75 million have had to 
comply with Section 404 to-date. With a further delay for smaller businesses, we will be better 
able to leverage the experience of larger companies and the auditing profession to ensure that 
implementation costs are minimized. Failure to do this could significantly undermine the cost- 
cutting objectives of the new standards. We also need to remain prepared to make additional 
changes if the new rules don’t work as intended. 

As it stands today, smaller companies will have to begin complying with the management 
requirements of Section 404(a) in their annual reports for fiscal years ending on or after 
December 15, 2007. They will have to comply with Section 404(b) requiring an auditor’s 
attestation report on internal control over financial reporting in their annual reports starting with 
the first annual report filed for the fiscal year ending on or after December 15, 2008. 

Two of the five SEC Commissioners — Commissioner Atkins and Commissioner Casey — 
have publicly indicated a willingness to reconsider such a delay. The Senate Committee on 
Small Business and Entrepreneurship led by Chairman Kerry and Ranking Member Snowe held 
a hearing on April 1 8, and the Senators have publicly called for a further delay. The Small 
Business Administration has also joined in to ask the SEC to revisit the issue of compliance 
deadlines. We urge this Committee to support this call for a reasonable, additional one-year 
extension for smaller issuers. 
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Additional Reforms to Enhance Small Business Competitiveness and Job Creation 

The Chamber believes that SOX has become a catch-all term to refer to a broader set of 
issues facing the public markets and smaller public companies in particular. While Section 404 
is a significant part of the problem, it is not tte only part. U.S. companies are facing changing, 
retroactively applied accounting rules that are ever-increasing in complexity. As a result, one in 
10 public companies was forced to restate its earnings last year. This system is not working for 
companies, investors, or auditors. 

America’s securities class action litigation system is broken. It provides inadequate 
compensation to injured parties without deterring future wrongdoers. It fails to protect small, 
undiversified investors, who seldom receive more than pennies on the dollar, while attorneys on 
both sides rake in millions of dollars in fees. Moreover, several recent bipartisan reports have 
highlighted the damage done by the private securities litigation system to U.S. competitiveness 
in the global capital markets and, as a result, to the U.S. economy as a whole. The system is not 
working. 

We have a regulatory structure filled with duplicative, inefficient, and, in some cases, 
contradictory guidance. Regulators have struggled to keep up with the speed and technology 
changes of today’s rapidly changing markets. While no business should be forced to read the 
minds of the regulators, it is particularly difficult for smaller public companies to deal with these 
issues. The system is not working. 


What Can We Do? 

The challenge is clear and the voices are growing. The Chamber’s independent, 
bipartisan Commission on the Regulation of U.S. Capital Markets in the 21st Century and others, 
including Hal Scott from Harvard, and Senator Schumer and Mayor Bloomberg have echoed that 
the problems facing our competitiveness are real and action is needed. We should remain united 
in our goal to make the U.S. capital markets the fairest, most efficient, transparent, and attractive 
in the world. 

That is why the Chamber formed the Center for Capital Markets Competitiveness in 
March 2007. The Center was established to advance legislative, regulatory, and legal initiatives 
designed to strengthen the competitiveness of U.S. capital markets. 

Granting a further delay for small business in complying with Section 404 would be a 
good step towards addressing these larger issues. But we cannot stop there. We need broad 
litigation and regulatory reform to retain our global capital markets leadership. 
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Conclusion 

Chairwoman Velazquez, Ranking Member Chabot, and members of the committee, thank 
you for the opportunity to discuss these serious issues. The Chamber stands ready to work with 
you and others to improve the implementation of SOX 404 — and we congratulate you for taking 
this important step by holding today’s hearing. We also applaud Chairman Cox and Chairman 
Olson for the work they have done. 

In summary, we believe that we will only know if the efforts of the SEC and PCAOB 
have been successful until after we see how they are implemented. Therefore, we are calling for 
a further delay of one full-year for smaller public companies before they must comply with 
Section 404. Finally, we urge Congress, the SEC, and other regulators to work together to 
address the additional critical issues that are making it increasingly difficult for leaders of 
smaller American companies to access the public capital markets to grow their businesses and 
create jobs. 

Thank you again for the opportunity to be here today. We stand ready to take action on 
behalf of the business community to provide viable solutions. 
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Opening Remarks 

Good afternoon, Madame Chairwoman Velazquez, Ranking Member Chabot, and Members of 
the Committee. Thank you for inviting me to testify on the new standards for internal controls 
over financial reporting recently established by the Securities and Exchange Commission and the 
Public Company Accounting Oversight Board. The costs and related burdens of implementing 
Section 404 of Sarbanes-Oxley have been, and continue to be, a serious problem for public 
companies, particularly smaller companies. 1 appreciate the Committee’s desire to further 
investigate ways to alleviate these problems. 

I am a partner in the Cincinnati, Ohio office of the law firm of Graydon Head & Ritchey LLP. 

As the Chair of our securities law practice, I work with both large and small public companies in 
a variety of industries. My testimony today is based on my 25 years of experience in 
representing, counseling and building relationships with my firm’s public company clients and 
their boards of directors, chief executive officers and chief financial officers in their real world 
experiences in navigating the regulatory requirements imposed upon public companies. Since 
the enactment of Sarbanes-Oxley nearly five years ago, 1 have worked more closely than ever 
with public companies in helping them become Sarbanes-Oxley compliant. As a result, 1 have 
gained substantial insights as to how directors and officers view these increasingly complex 
requirements. 

In preparing my testimony, I have asked a number of officers of several different public 
companies about their current thoughts and expectations about Section 404 and the new SEC and 
PCAOB standards. However, the views that I share with the Committee today ate my own views 
and should not be attributed to Graydon Head & Ritchey or to any client of my law firm. 

My objective is to address three primary topics with the Committee; (1) the most significant 
problems that implementation of Section 404 has caused for public companies; (2) whether the 
SEC’S and PCAOB’s new standards are likely to effectively alleviate those problems; and (3) the 
need to continue to evaluate whether Section 404 is serving its intended purposes. 

1. Significant Problems Caused by Section 404 

This Committee, the SEC and the PCAOB are well aware that the implementation of Section 404 
of Sarbanes-Oxley has been problematic, I will not attempt to identify every problem that public 
companies have encountered in seeking to comply with the Section 404 requirements for internal 
controls over financial reporting as the myriad of problems are well documented in various 
reports compiled by the SEC. What 1 will do is to emphasize that the mo.st significant and 
troubling problems facing public companies, and particularly smaller public companies, are (1) 
out-of-pocket costs, (2) diversion of limited internal resources, and (3) deteriorating relationships 
with their independent, outside auditors. 

• Out-of Pocket Costs: The additional out-of-pocket costs required to comply with 
Section 404 are extremely high. Virtually every public company that I have talked with 
has experienced at least a doubling of its audit costs each year since being subjected to 
Section 404 compliance. Initially, the extra cost burden in the first year of 
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implementation was seen as extreme by most companies, however, they have now 
discovered that these costs do not significantly reduce in subsequent years. 

Importantly, studies have also confirmed that the cost of Section 404 compliance is 
disproportionately higher with respect to smaller public companies. Although a larger 
company may have incurred an additional $2.0 million of auditing costs attributable to 
Section 404 compared to only $500,000 by a smaller company, the larger company 
typically is offsetting those costs against a much larger bottom line. If the smaller 
company only generated $1.0 or 2.0 million in net income to begin with, the extra 
compliance costs very materially reduce such net income and directly lowers the value of 
the company for its shareholders. 

• Diversion of Limited Internal Resources: In addition to direct costs, public companies 
must also allocate substantial internal human resources to the Section 404 compliance 
process. Those costs are hard to measure precisely, but public companies firmly believe 
that the substantial time that many key employees must devote to Section 404 compliance 
would better benefit shareholders if focused on running and growing the company’s 
business. Again, this problem is even more pronounced for smaller public companies 
who have fewer employees and who frequently have significant budget restraints on 
hiring additional employees. The result is that highly qualified chief financial officers 
and controllers must do much of this work themselves in smaller public companies, yet 
the involvement of these individuals is greatly needed in other aspects of the business as 
well. 

• Deteriorating Relationships with Independent, Outside Auditors: Section 404 
compliance has been a major contributor to a deteriorating relatioaship between public 
companies and their auditors. In the past several years, I have heard numerous public 
company officers describe their relationship with their outside auditors as “adversarial.” 

I don’t recall ever having heard such comments prior to the implementation of Section 
404. $Ve all agree that it is critically important that a company’s outside auditors be 
independent of management, but Section 404 has had the unintended consequence of 
cutting off productive and necessary consultations with the auditors who historically had 
been among a company’s most trusted advisors. 

The reason for this problem is that many companies discovered that if they had to ask 
their auditors for advice on how to handle complex accounting issues, then the auditors 
felt compelled to characterize the need to ask as either a significant deficiency or worse, a 
material weakness because the company should have known. Of course, this is a fallacy 
in that many accounting, tax and other issues require much Judgment and analysis. 
Nonetheless, the fear of being tagged with having material weaknesses causes smaller 
public companies to no longer ask legitimate questions for needed advice. The company 
either makes a Judgment the best it can based on the amount of time its key people can 
devote to analyzing the relevant issues, or the company can incur even more additional 
expense by engaging yet another accounting firm to advise it on those matters 
notwithstanding that such other accounting firm does not know nearly as much about the 
company as does the company’s current audit firm. The fhistration experienced by small 
public companies in these cases is exacerbated by the fact that the outside auditors also 
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frequently would not have had definitive answers, yet management is not even able to 
determine the auditors’ general thinking on these complex matters until the Section 404 
audit is underway months later. 

The relationship between a company and its auditors has been further strained by the 
Section 404 process in cases where a company perceives their outside auditors as being 
inflexible, lacking judgment and/or conducting excessive testing and analysis of internal 
controls regardless of materiality. Although the auditors in the field historically are very 
familiar with their audit client’s business, many audit firms have taken a centralized 
approach to Section 404 which has resulted in a “if it’s good for Company A, then it must 
be good for Company B” mentality. This has caused auditors to insist on implementation 
of various procedures and the undertaking of extensive testing on many matters that are 
not .seen as being at all relevant to the particular company being audited. Because these 
requirements are being imposed from above, i.e. the audit firm’s national office or in 
some cases the PCAOB, the auditors in the field are powerless to adapt even if they 
would otherwise be so inclined. The reluctance of audit firms to make modifications is 
undoubtedly (and Justifiably) also tied to liability concerns given that the accountants 
have been the deep pockets for substantial claims based upon their client company 
misconduct or mistakes. 

I emphasize these problems because I can assure you that these problems are in fact being 
experienced virtually everyday by our nation’s public companies. These problems are draining 
not only cash fixim otherwise solid and viable companies, but also adversely impact the 
entrepreneurial spirit of these officers in wanting to build a company for the long term. More 
and more public companies have no choice other than to at least consider the possibility of going 
private and exiting the public markets altogether. 

I also work with many successful privately held companies, including entrepreneurial new 
ventures. Ten years ago, it was very common for these companies to aspire to someday go 
public and to use the public capital markets as a way to grow the company. In today’s 
environment, these types of companies express virtually no interest in going public and cite the 
regulatory burdens as the main concerns. While the aggregate dollar volume of IPOs may be on 
the rise in recent years, increasingly it is the case that the public markets are not truly open for 
smaller companies. My first underwritten public offering in 1986 raised a whopping $600,(X)0 in 
gross proceeds. While that was atypically small even then, it would be difficult to recommend 
that any company conduct an IPO today for less than $100 million. 

Yet another ominous sign for the U.S. public markets is the new unregistered stock trading 
system recently devised by Goldman Sachs. This system is designed to create a trading market 
in privately held companies but to keep them at less than 500 shareholders so not to trigger SEC 
reporting obligations. Investments in these “listed private companies” will be limited to 
institutional investors, thereby limiting investment opportunities for the general public. Perhaps 
even more telling is that a leading investment banking firm would believe that such an 
unregistered trading system is advantageous given that the public capital markets have been the 
life blood of investment banking. 
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I believe the case is clear that small companies need relief from the enormous regulatory burdens 
being imposed upon them. While Section 404 is by no means the sole cause of those burdens, it 
is an area ripe for improvement as 1 will next discuss. 

2. Anticipated Ability of New SEC and PCAOB Standards to Remedy Section 404 
Problems 

The SEC and PCAOB have expended extraordinary time and effort to identify, analyze and 
attempt to develop solutions for the myriad of problems resulting from Section 404. This is 
evidenced by the large number of hearings, public meetings, proposal drafts, comment 
solicitations and other related actions to try to balance the needs and burdens on public 
companies with the need for quality reporting and confidence in the public markets. These 
actions are highly commendable and should be greatly appreciated. I believe that the SEC and 
PCAOB have done an excellent job of developing standards that, in theory, should alleviate 
some of the above problems. 

The SEC and PCAOB’s new standards contain many concepts that do address the main problems 
posed by Section 404. Companies and auditors are being guided to take a top down approach 
focusing on identifying the true risk areas and materiality. The new standards also contemplate 
scalability and recognize that all companies are not the same and that the nature and types of 
controls needed in various companies can vary. Of great significance is that the new standards 
allow' for the auditors to undertake work relating to internal controls if the company’s audit 
committee approves. The new standards also allow the auditors to rely on the work of company 
employees, not just the internal auditors which many smaller public companies do not have. The 
combination of these factors should reduce costs and improve relationships between companies 
and their auditors. 

Unfortunately, I must report to you that smaller public companies are for the most part highly 
skeptical that the new standards will bring actual relief. In some instances, this skepticism 
results from conversations that have already transpired between the public company and its 
auditors. Those conversations have made clear that the auditors are not anticipating any 
significant changes in the way they approach the Section 404 audits, notwithstanding the new 
standards. If the auditors are not willing in practice to buy into the new standards, then it is 
highly doubtful that public companies will experience any meaningful cost reduction in Section 
404 compliance or that internal resources will be freed to focus on the company’s operations, 
strategy and vision which ultimately build shareholder value. While we can only speculate at 
this point at to why auditors may not embrace the new standards, reluctance to change their 
processes may well be due to concerns of potential liability if their practices are not uniformly 
applied. 

Even as to those companies which are more optimistic about the willingness of their auditors to 
work within the new standards, their expectation as to cost savings is modest. At this point, they 
anticipate that a 10 - 15% reduction in audit costs is about the best that would result. Those 
companies that are already complying with Section 404 also have concern that it will be costly to 
convert to the new standards as much of the same work that was needed in the initial 
implementation of Section 404 would have to be repeated in order to determine what items can 
be scaled back. Now that they have experienced at least two years of the Section 404 audit, it 
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may be easier and more cost effective to simply keep the existing processes substantially in 
place. These companies believe that as long as they can continue to demonstrate to their auditors 
that they are following the established internal control procedures that were sufficient to allow 
the company to get a “clean” Section 404 report, then it would not be prudent to change those 
procedures at the risk of getting a different result. 

Recommendation ifl. The primary perceived obstacle to the potential success of the SEC’s and 
PCAOB’s new standards is the willingness and ability of the outside auditors to adapt their 
thinking and procedures to align with the principles and guidance set forth in those standards. 
Because the PCAOB is charged with overseeing and evaluating public accounting firms, the 
PCAOB should make clear that part of its evaluation process will be to determine whether the 
audit firms are changing from a “one size fits all” and “everything is material” standard. 

Although the PCAOB has limited powers, the PCAOB needs to strongly encourage public 
accounting firms to buy into the new standards and to be critical of firms that do not. While 
beyond the power of the PCAOB and the SEC, reducing the potential liability of auditors for 
Section 404 audits could be warranted. 

Recommendation #2. The SEC should grant non-accelerated filers another extension of time 
before compliance with the new standards is required. So far, the SEC has determined not to 
provide additional time notwithstanding the cry of many interested parties requesting such an 
extension. 

An extension is warranted for several reasons, including: 

• First, to begin with, the phased implementation of Section 404 presumably was to allow 
smaller companies to learn from the experiences of larger companies and their auditors in 
implementing Section 404. The new standards create a substantially new and different 
framework for implementing and auditing internal controls than what the large 
accelerated filers and accelerated filers have experienced in prior years. The smaller 
public companies should not be the guinea pigs in determining how to implement the new 
standards. 

• Second, the accounting firms need time to review their practices and procedures in light 
of the new standards and to modify those practices and procedures as they deem 
appropriate. The accounting firms also need time to educate their own staffs on such 
changes before the internal control auditing process is undertaken. Moreover, if the non- 
accelerated filers are now added to the number of companies for which internal controls 
must be audited, there undoubtedly will be even more new hires by the accounting firms 
to handle the increased demand, many of which new hires may have little or no 
experience in auditing internal controls under either the old or new standards. 

• Third, the non-accelerated filers have already lagged behind their larger public company 
counterparts in implementing Section 404 without any indication that the public markets 
and investors have been clamoring for these companies to commence compliance. 

Another time extension of one or more years, if not permanently, would not appear to 
greatly increase risk to the markets or investors. 
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3. Continued Evaluation of the Effectiveness of Section 404 

In reading the various proposals and related materials prepared by the SEC and the PCAOB, it is 
apparent to me that they have concluded that (1) Section 404 is improving the quality of financial 
reporting, decreasing the risk of fraud and improving investor confidence, and (2) reducing the 
cost of implementing Section 404 will eliminate the majority of concerns and objections that 
public companies have regarding Section 404. 

I believe that declaring Section 404 to be effective in the above respects is premature, if not 
entirely incorrect. I also believe that reducing the Section 404 costs will not mean that Section 
404 compliance is cost effective. 

In talking with public companies about Section 404, they are virtually unanimous in their strong 
belief that they had good internal controls before Section 404 was thrust upon them and that 
Section 404 has not been effective, and cite the following examples; 

• The additional documentation and procedures that they have been forced to adopt in 
order to satisfy the auditors have been largely focused on minutiae and are unnecessary. 

• Their financial reporting is not significantly improved as a result of implementing Section 
404, and believe that the public markets and investors do not place significant value on 
the interna! control reports. 

• Many companies have had to restate their financial statements in recent years, but not 
because their internal controls were more effective. Large numbers of restatements have 
been necessary due to the ever increasing complexity of accounting rules and tax laws, 
which require companies to use their best judgment on how to report certain items. In 
subsequent years, as companies and auditors gain more experience in applying those new 
rules and standards begin to emerge, it is not uncommon for companies to later discover 
that their best judgment did not comport with the prevailing view and then the prior 
years’ numbers must be adjusted. Fortunately, knowledgeable investors are increasingly 
able to distinguish between restatements that are driven by highly technical rules and 
restatements that indicate serious problems within a company. 

It is also clear that many of the restatements are being made by companies that had 
received clean audit reports on their internal controls for the years being restated. In 
many of those cases, the need to restate triggers a determination by the company and/or 
the auditors that a material weakness had existed so the audit report gets changed months 
or even years later. In those cases, it is difficult to conclude that financial repotting has 
been improved or that the financial statements are more reliable because of the auditor’s 
Section 404 audit report. 

While many of the Sarbanes-Oxley requirements have been beneficial to companies, their 
shareholders and the investing public, the jury should remain out on Section 404. Many public 
companies would urge Congress to repeal Section 404 for the various reasons, including those 
discussed above. 


7 



118 


Although it is my understanding is that it is highly unlikely that Section 404 will be repealed, I 
would be remiss if I did not ask this Committee to at least remain open to that possibility. 

Failing the complete repeal of Section 404, 1 would suggest to the Committee that the current 
batch of non-accelerated filers who have not yet been required to comply with Section 404 and 
new public companies in the future be exempt from Section 404 implementation until such time 
as they achieve certain thresholds. The market capitalization threshold should be increased 
substantially, at least to $500 million and arguably higher. A net income test should also be 
established to alleviate the disproportionate impact of compliance costs on smaller companies. 
While changing these thresholds will not benefit companies that have already complied with 
Section 404, this step would help minimize concerns of companies considering going public that 
the ongoing compliance costs are too high to overcome. 

Conclusions 


The implementation of Section 404 continues to be a significant burden for public companies, 
even more so for smaller companies. The SEC’s and PCAOB’s new standards may alleviate 
some of those problems, but Section 404 is likely to continue to be particularly burdensome on 
small public companies for years to come. Ideally, Section 404 itself would be repealed, or at 
least the nation’s small public companies could be granted a longer term exemption from 
compliance. 

1 appreciate the opportunity to appear before you today to address these important issues. I will 
welcome any questions that you may have. Thank you. 
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The Independent Community Bankers of America (ICBA)' appreciates the opportunity to 
offer this statement before the House Small Business Committee concerning the impact 
that the new guidance and standard under Section 404 of the Sarbanes-Oxley Act of 2002 
(SOX) will have on small business. Section 404 requires publicly held companies to 
include an assessment by management of the effectiveness of a company’s financial 
controls and procedures in their annual reports and to have the company’s auditor attest 
to the effectiveness of the company’s internal controls and procedures. 

Approximately two weeks ago, the Securities and Exchange Commission (SEC) 
approved new guidance for management under SOX Section 404(a) (the “SEC 
Guidance”). At the same time, the Public Company Accounting Oversight Board 
(PCAOB) approved a new internal control auditing standard under SOX Section 404(b), 
An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit 
of Financial Statements (referred to hereafter as Auditing Standard No. 5 or “ASS”), that 
would supersede Auditing Standard Number 2. The purpose of both the SEC Guidance 
and ASS is to (1) clarify the requirements of SOX Section 404(a) for management and (2) 
simplify and scale the internal control audit required by Section 404(b) so that outside 
auditors would focus on those matters most important to internal control. 

Summary of ICBA’s Position 

• While the SEC Guidance and ASS may curtail excessive testing of controls and 
reduce some of the unnecessary documentation required by SOX 404 audits, 
ICBA still has doubts that it will reduce 404 audit costs, particularly for smaller 
public companies. 

• ICBA is disappointed that the SEC did not adopt our recommendation to delay by 
one year the Section 404 due dates for non-accelerated filers so that they would 
have until the due date for their 2008 annual report to file their management 
internal control reports and the due date for their 2009 annual report to file the 
auditor’s attestation report. The additional one- year delay would have given the 
SEC and the PCAOB an opportunity to evaluate the impact and the cost 
effectiveness of their proposed guidance on accelerated filers and would also have 
given non-accelerated filers that have no experience with Section 404 additional 
time to understand and apply the new guidance and establish a new internal 
control framework. 


’ The Independent Community Bankers of America represents the largest constituency of community banks of all 
sizes and charter types in the nation, and is dedicated exclusively to representing the interests of the community 
banking industry. ICBA aggregates the power of its members to provide a voice for community banking interests 
in Washington, resources to enhance community bank education and marketability, and profitability options to 
help community banks compete in an ever-changing marketplace. 

With nearly 5,000 members, representing more than 18,000 locations nationwide and employing over 265,000 
Americans, ICBA members hold more than $876 billion in assets $692 billion in deposits, and more than $589 
billion in loans to consumers, small businesses and the agricultural community. For more information, visit 
ICBA 's website at www.icba.org. 
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• To indicate that it is serious about reducing costs, ICBA believes that the SEC 
should have set a quantitative benchmark or goal for the new standard that would 
be tied to a reduction in overall SOX 404 audit costs. 

• While a risk-based and scalable AS2 may reduce some of the high costs of SOX 
Section 404, ICBA still believes that smaller public companies should be partially 
or fully exempted from Section 404 in order to be competitive with larger 
companies and foreign competition. 

Comments Concerning ASS and the SEC Guidance 

We commend the SEC and the PCAOB for their efforts to create a scalable, top-down 
approach for SOX 404 audits. As noted in the release for the proposed SEC Guidance, 
the SEC Advisory Committee on Smaller Public Companies raised a number of concerns 
regarding the ability of smaller companies to comply cost-effectively with the 
requirements of SOX 404. Some of the concerns stemmed from the implementation of 
AS2 and the fact that auditors were engaged in excessive testing of controls and requiring 
unnecessary documentation to comply with SOX 404. 

We also commend the PCAOB for aligning ASS more closely with the SEC guidance and 
making the new standard more scalable for smaller public companies. By using the same 
definitions of “material weakness” and “significant deficiencies” in ASS that the SEC 
uses in its final management guidance, the PCAOB has gone a long way in making the 
new standard more in sync with the SEC guidance. Eliminating the “principal evidence” 
provision and changing walkthroughs from a mandatory requirement to a recommended 
step will help make ASS more flexible for smaller public companies. 

However, while the SEC Guidance and proposed ASS may curtail excessive testing of 
controls and reduce some of the unnecessary documentation required by SOX 404 audits, 
we still have doubts that it will reduce 404 audit costs, particularly for smaller public 
companies. We note, for instance, that ASS has not been field tested so there is no 
evidence to suggest that, despite the proposed standard’s focus on scalability and risk- 
based testing, auditors will significantly change their audit procedures or reduce the time 
they take to perform a 404 audit. 

ICBA is disappointed that the SEC did not adopt our recommendation to delay by 
one year the Section 404 due dates for non-accelerated filers so that calendar year 
filers would have until the due date for their 2008 annual report rather than the due 
date of their 2007 annual report to file their management internal control reports. 

The one-year delay would have accomplished several things. First, it would have given 
the SEC and the PCAOB an opportunity to evaluate the cost effectiveness of their 
controls on accelerated filers. If, for instance, the SEC Guidance and ASS would have 
had little impact on SOX 404 audit costs for the 2007 and 2008 accelerated filers, then 
the SEC and the PCAOB would have time to revise the guidance and the new standard 
before it is fully implemented by non-accelerated filers. Second, a one-year delay would 
also have given non-accelerated filers that have no experience with Section 404 
additional time to understand and apply the new guidance and establish a new internal 
control framework. As it stands, non-accelerated filers will have a very limited time — 
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approximately six months — to prepare the management assessment of controls in 
accordance with the new guidance. 

ICBA also believes that the SEC and the PCAOB should have established a 
quantitative benchmark or goal for the new standard that is tied to a reduction in 
overall SOX 404 audit costs. For instance, the SEC and the PCAOB should have stated 
that the goal of ASS is to reduce average internal control audit costs by a certain 
percentage — say 20%, with a commitment that if the revised standard does not meet that 
goal, then the standard would be revised further. It is too ambiguous for the SEC or the 
PCAOB to state that their goal is to increase the “cost effectiveness of the 404 audit” or 
“to eliminate unnecessary audit procedures” particularly when there has been no field 
testing of the new standard and therefore no assurance that it will reduce costs. A specific 
benchmark or goal would have conveyed to the industry that the SEC and the PCAOB is 
serious about reducing the overall costs of SOX 404 and is committed to achieving that 
goal. 

Defined Terms Need to be Clearer 

While we agree that the SEC and the PCAOB have made some progress in clarifying 
some of the defined terms used in AS2, we believe there is more room for improvement. 
Specifically, there will still be confusion about what constitutes a “material weakness” 
and how management should identify material weaknesses. AS2 currently defines a 
material weakness as a control deficiency, or a combination of control deficiencies, that 
result in more than a remote likelihood that a material misstatement of the company’s 
annual or interim financial statements will not be prevented or detected. In ASS and SEC 
Guidance, the SEC and the PCAOB use the same definition but substitute “reasonable 
possibility” for “more than a remote chance.” 

While “reasonable possibility” is clearer than “more than a remote chance” and possibly 
raises the threshold to some degree, the definition still requires management and auditors 
to prove a negative — that no material weaknesses exist — as opposed to affirmatively 
proving the effectiveness of internal controls. This negative approach — ^proving that no 
material weaknesses exist — places an enormous burden on auditors and management who 
must attest to the internal control over financial reporting and encourages them to be very 
conservative with their testing and documentation. 

ICBA believes a more precise definition of “material deficiency” that is tied to the impact 
on a company’s earnings would have been very helpful. Last year, ICBA supported the 
COMPETE Act,^ introduced by Rep. Tom Feeney (R-Fla.), that directed the SEC and the 
PCAOB to use a 5% de minimus standard (e.g., 5% of profits) under AS2 for noting 
material deficiency. Furthermore, if management and the auditors must prove the 
negative — that there are no “material deficiencies” in their internal controls — ^then 
greater clarity as to how companies both large and small can achieve that goal would 
have been beneficial. The guidance should also have indicated at what point a 
combination of control deficiencies give rise to a material weakness. Illustrations of 


^ HR 5404, known as the “Competitive and Open Markets that Protect and Enhance the Treatment of 
Entrepreneurs Act." 
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different control deficiencies that rise to a material weakness would be useful. Both the 
SEC Guidance and ASS should be clear enough so that management does not have to 
consult with their auditors every time there is an issue about a “material deficiency.” 

There are other examples of defined terms that should have been clarified. For instance, 
the SEC Guidance indicates that management is required to assess whether a company’s 
internal controls are effective in providing “reasonable assurance” regarding the 
reliability of financial reporting. “Reasonable assurance” is defined as assurance that 
would “satisfy prudent officials in the conduct of their own affairs.” This definition is 
entirely too vague. At a minimum, the SEC should have provided illustrations so that 
companies have a clearer idea of what it means to be “reasonably assured.” As 
mentioned above, the guidance should be clear enough that management does not have to 
constantly refer to experts (i.e., an outside auditor) to understand the definitions. 

The SEC Guidance Should Provide a Clear Safe-Harbor for Management 

The SEC Guidance says that the proposed amendments to Rules 13a-15(c) and 15d-15(c) 
will make the SEC Guidance “similar” to a non-exclusive safe-harbor. ICBA 
recommended that the SEC provide a clear safe harbor for management under the 
Securities and Exchange Act of 1934 provided that management has complied with all 
aspects of the SEC Guidance. A clear safe harbor would make it more likely that 
management will detect material weaknesses and disclose them since management will 
realize that it has some legal protection under the Exchange Act. Furthermore, 
management will be more likely to rely on its own interpretation of the guidance and not 
constantly seek advice from auditors. 

The SEC rules contain a number of safe harbors that have been very successful, including 
Rule 144A under the Securities Act of 1933 which provides a safe harbor from 
registration for re-sales of privately placed securities to qualified institutional buyers and 
Regulation D, which is a safe harbor from registration for certain private placements of 
securities. In each case, these safe harbors have provided a clear way for parties to 
comply under the securities laws. The SEC should provide a clear safe harbor for 
management under the Exchange Act that provides legal protection similar to these other 
safe harbors. 

Even With a Scalable ASS, ICBA Endorses a Small Company 404 Exemption 

ICBA commends the SEC and the PCAOB for their endorsement of a scalable approach 
to SOX 404 audits. ASS, for instance, does incorporate a discussion of scaling concepts, 
similar to what was proposed, throughout the final standard. Specifically, notes to 
relevant paragraphs in the new standard describe how to tailor the audit to the particular 
circumstances of a smaller, less complex company. We understand that ASS will provide 
the foundation for plaimed guidance on auditing internal control in smaller companies to 
be issued later this year. 

While a risk-based and scalable AS2 may reduce some of the high costs of SOX 
Section 404, ICBA still believes that smaller public companies should be partially or 
fully exempted from Section 404 in order to avoid unnecessary costs and to be 
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competitive with larger companies and foreign competition. Even with a revised 
auditing standard, we believe that smaller public companies would still be subject to 
unnecessarily extensive auditing of detailed control processes under Section 404 by 
auditors unduly concerned about their liability and being second guessed by the PCAOB. 

ICBA strongly endorses the primary recommendations of the SEC’s Advisory 
Committee on Smaller Public Companies including (a) exempting micro-cap 
companies (with equity capitalizations of $128 million or less) that have revenue of 
less than $125 million from the internal control attestation requirements of SOX 
Section 404 and (b) exempting small-cap companies (with equity capitalizations of 
between $128 million and $787 million) that have revenue of less than $250 million 
from the external audit requirements of SOX Section 404. We agree with the 
Advisory Committee that with more limited resources, fewer internal personnel and less 
revenue with which to offset the costs of Section 404 compliance, both micro-cap and 
small-cap companies have been disproportionately impacted by the burdens associated 
with Section 404 compliance. We also agree that the benefits of documenting, testing 
and certifying the adequacy of internal controls, while of obvious importance for large 
companies, are of less value for micro-cap and small-cap companies, that rely to a greater 
degree on “tone at the top” and high-level monitoring controls, to influence accurate 
financial reporting. 

The proportionately larger costs for smaller public companies to comply with Section 404 
adversely affect their ability to compete with larger public companies and even with 
foreign competition. This reduction in the competitiveness of U.S. smaller public 
companies hurts their capital formation ability and, as a result, hurts the U.S. economy. 

For community banks, Section 404 costs have been particularly significant. ICBA’s 2005 
survey of Section 404 costs for community banks revealed that the average community 
bank would spend during 2005 more than $200,000 and devote over 2,000 internal staff 
hours to comply with Section 404.^ These costs far outweigh the benefits for these small 
companies. 


Conclusion 

ICBA is disappointed that the SEC did not grant another one year delay in the Section 
404 due dates for non-accelerated filers so that they would have until the due date for 
their 2008 annual report to file their management internal control reports and the due date 
for their 2009 annual report to file the auditor’s attestation report. The additional one- 
year delay would have given the SEC and the PCAOB an opportunity to evaluate the 
impact and the cost effectiveness of their proposed guidance on accelerated filers and 
would also have given non-accelerated filers that have no experience with Section 404 
additional time to understand and apply the new guidance and establish a new internal 
control framework. 


’ For a complete description of ICBA’s Section 404 Survey of Community Banks, see ICBA’s comment 
letter to the SEC dated March 3 1 , 2005 concerning the formation and goals of the Advisory Committee. 
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To indicate that it is serious about reducing costs, ICBA also believes that the SEC 
should have set a quantitative benchmark or goal for the new standard that is tied to a 
reduction in overall SOX 404 audit costs. While a risk-based and scalable AS2 may 
reduce some of the high costs of SOX Section 404, ICBA still believes that smaller 
public companies should be partially or fully exempted from Section 404 in order to 
avoid unnecessary costs and to be competitive with larger companies and foreign 
competition. 

ICBA appreciates the opportunity to offer this statement before the House Small Business 
Committee concerning the impact that ASS and the SEC guidance under Section 404 of 
the Sarbanes-Oxley Act will have on small business. 
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The Institute of Management Accountants (“IMA”) has been an active and critical 
commentator on SOX regulatory regime over the past 2 years. With a worldwide 
network of nearly 65,000 professionals, IMA is the world's leading organization 
dedicated to empowering accounting and finance professionals to drive business 
performance. 

Given the importance and impact of the current regulatory regime on U.S. global 
competitiveness we have invested considerable resources researching issues linked to the 
practicality, efficiency, and effectiveness of the current SOX section 404 regulations. 
Most recently we viewed the SEC webcast on May 23 announcing the new SEC guidance 
for management, studied the transcript of the webcast, viewed the PCAOB webcast on 
May 24* outlining the key elements of the new guidance for external auditors, and have 
carefully studied the text of Auditing Standard No. 5 issued on May 24* — all with the 
historical predicate of having completed an independent multi-year study, surveying its 
members, conducting roundtable meetings for Congressional Members and staff, and 
participating in the bill-drafting process. 

IMA’s conclusion is that the May 2007 SOX section 404 implementation guidance is 
still seriously sub-optimal and that further delay, backed by a more radical and 
time-bound action plan, is necessary for small companies. It is our opinion that full 
implementation of the costly and error-prone control assessment methods proposed in the 
revised regulations will negatively impact the growth, success and global competitiveness 
of the more than 12,000 U.S. listed non-accelerated filers. We do not consider the internal 
control over financial reporting (ICFR) assessment approach mandated by the SEC or 
PCAOB in the latest revisions to be in line with global risk management standards that 
allow testing and documentation to be focused on the high risk areas. Most disturbingly, 
there is a growing amount of evidence that indicates the current control assessment 
methods mandated by Auditing Standard No. 2 have high prediction error rates. Large 
accelerated filers are better able, both in terms of financial resources and personnel, to 
deal with the burden that comes with the onerous and unnecessary regulatory costs (direct 
and indirect) that we believe will still accompany the revised SOX 404 regulations. The 
flaws in the current regulatory regime have the potential to significantly harm smaller 
public companies and undermine U.S. competitiveness. 

The fact that the SEC has publicly stated during the May 23 webcast that they are either 
unable and/or unwilling to project the magnitude of any cost reduction that may 
accompany this new guidance relative to the current 404 regulatory regime should be a 
major cause for concern. During the SEC May 23 webcast Ms. Murphy, in response to a 
question from Commissioner Atkins that touched on the massive SEC section 404 
implementation cost estimation error made in June 2003, shed little light on the specifics 
of how the new SEC regulations will lower section 404 implementation costs. Ms 
Murphy, an economist at the SEC, stated: 

The incremental benefits and costs of this particular rule are relative to what would 
happen without the guidance that is being provided to management and the change in the 
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requirements of the auditor to do interpretation that they are now not going to have to 
do, and so from that perspective, there is uncertainty. 

After carefully reading the transcript of the SEC webcasts, we are unable to see that any 
serious analysis has been done to date to ascertain specifically how the new SEC/PCAOB 
guidance wilt afford significant cost relief to non-accelerated filers. We are disappointed 
that the SEC does not appear to have attempted to systematically identify and enumerate 
where cost savings are expected to flow from their new guidance given that the cost 
burden imposed by the PCAOB Auditing Standard No. 2 has been the number one 
complaint with SOX 404 rules to date. This is even more disappointing given the 
magnitude of error in the original SEC section 404 cost burden estimates - a number 
originally estimated to be around $91,000 per company. The reality has been that more 
than a few large accelerated filers incurred costs that exceeded $50 million dollars in the 
initial implementation round and some estimates place the average cost of accelerated 
filers at more than $4 million. We believe that the SEC should make a concerted effort to 
estimate what the compliance cost for a typical non-accelerated filer should be both in 
terms of section 404(a) and 404(b) under the new rules contrasted to the expected costs 
that would have been sustained under the prior mles driven largely by Auditing Standard 
No. 2. This has not been done. 

We support a call for additional implementation delay, and believe that delaying the 
implementation of section 404 should be facilitated by U.S. legislators whereby they 
intervene and amend the Sarbanes-Oxley Act to guide the SEC and PCAOB down a more 
technically sound implementation path. 

The SEC and PCAOB have both indicated that the revised section 404 guidance released 
in May represents their best effort to correct the severe problems that have accompanied 
the SOX regulatory regime to date. During the PCAOB webcast on May 24, 2007 Bill 
Gradison, in the final closing remark prior to the vote to accept AS No.5, stated: 

Let’s face it, this is our last chance to get the internal control standards right. I believe 
we have. Others will Judge. 

With respect, based on our technical analysis, we do not believe the SEC and PCAOB 
have succeeded in their latest efforts to make the internal controls assessment standards 
“right”. 

It is important to note that the majority of the SEC and PCAOB staff that worked on the 
May 2007 guidance are the same personnel that created and endorsed the original internal 
control assessment requirements - requirements that resulted in the largest regulatory 
estimation error in the history of securities regulation. We are very concerned the SEC 
and PCAOB lack personnel with the necessary skills and experience in the area of 
globally-accepted risk-based assessment methodologies. The methods proposed to date 
largely date to the methods taught and used in the late 1970s. Lynn Turner, former SEC 
Chief Accountant, in February 2007 at the PCAOB Standing Advisory Group stated: 
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The current interpretation of risk-based auditing is one that is written by auditors for 

auditors The current interpretation in the SOX regulations of risk-based is pretty 

much the same thing we have had for the last two decades. 

The absence of genuine risk assessment skills is graphically illustrated in the December 
2006 draft SEC guidance to management on how to identify the significant risks. On 
page 23 that guidance states: Management uses its knowledge and understanding of the 
business, its organization, operations and processes to consider the sources and potential 
likelihood of misstatements in the financial reporting elements and identifies those that 
could result in a material misstatement to the financial statements. 

Risk professionals have learned that utilizing only an experiential approach to identifying 
and assessing risks is a recipe for disaster. Contemporary risk assessment methods 
supplement the experience and knowledge of staff with information on risks drawn from 
other relevant organizations, use a range of techniques to produce a universe of relevant 
risks, and place huge emphasis on rigorous analysis of system failures to continuously 
update and improve an organizations understanding of risk. The IMA Statement on 
Management Accounting issued in January 2007 titled Enterprise Risk Management 
Frameworks, Elements and Integration provides an overview of innovations in the field. 

To date, the SEC and PCAOB have, in the spite of extensive feedback from a range of 
commentators citing deficiencies in the December 2006 drafts, elected to largely stay the 
course they charted in December. Given their resistance to make fimdamental changes to 
the December exposure drafts, the only viable option that we see at this point is for U.S. 
law makers to redirect the SOX regulatory regime down a path that will be cost effective 
and practical for smaller public companies. This is unfortunate as we have always stated 
unequivocally that we support the intent and wording of the Sarbanes-Oxley Act as 
enacted by our elected representatives. It is often stated that “THE DEVIL IS IN THE 
DETAILS”. In our opinion, the devil is still in the May 2007 SOX 404 regulatory 
guidance and needs to be exorcized. 

On the next page we list the major areas of deficiency in the current regulatory guidance 
that require immediate legislative intervention : 
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Major Deficiencies in Section 404 Regulations for Smaller 
Public Companies 

1 . COST - We believe that the May SEC/PCAOB guidance will still perpetuate 
unnecessary costs. Primary cost drivers are: the current regulations are still not 
truly risk-based, resulting in spending on assessment and testing that is not 
proportionate to the real risk; inadequate guidance regarding how to direct 
resources proportionate to the level of current and potential risk; and continuation 
of excessive focus on process level control testing. Cost levels will continue to be 
materially impacted by the SEC/PCAOB decision to have auditors form 
subjective independent decisions on control effectiveness in a world where they 
face severe litigation liability for wrong opinions. We continue to assert that costs 
would be lower if auditors were only required to opine on the reasonableness of 
the assessment process management uses to provide section 404(a) 
representations. 

2. CURRENT CONTROL EFFECTIVENESS PREDICTION ERROR RATE 
- The current control assessment methods mandated by Auditing Standard No. 2, 
and largely perpetuated in the May 2007 guidance, are producing inordinately 
high prediction error rates. Simply stated, the control assessment methods are 
seriously unreliable and thousands of control representations by management and 
auditors are being proven to be materially wrong. Management and auditors are 
concluding under the rules currently in force that controls are “effective” beyond 
a remote likelihood. Subsequent events are then proving these “control 
effectiveness predictions” to be wrong in an unacceptably high number of cases. 
The frequency with which auditors are still finding material errors in draft 
financial statements after controls are assessed as effective, resulting in “back- 
door” material weakness disclosures, continues to be very high. The frequency of 
restatements of prior years where both management and auditors concluded 
controls were effective is alarming. A February 2007 report from Audit Analytics 
reported that the fi-equency of restatements among Accelerated Filers was 13.3% 
in 2006; or stated another way, more than one in eight financial statements that 
were certified as reliable by both management and auditors were subsequently 
proven to be materially wrong. These companies will have spent many millions of 
dollars complying with the current section 302 and 404 reporting requirements. 
Use of these severely flawed methods has so far been restricted to the much 
smaller accelerated filer registrant populations. Mandating the use of seriously 
flawed assessment methods to the approximate 12,000 non-accelerated filers 
is not advisable. We believe that additional rigorous research to determine the 
cause of the current control effectiveness prediction error rates is desperately 
needed. 

3. RELATIONSHIP WITH EXTERNAL AUDITORS - Smaller public 
companies often lack the quantity and depth of resources necessary to interpret 
accounting rules that are increasingly complex and a primary cause of 
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restatements. Although little has been said on the subject, the reality has been that 
external auditors often interpret accounting rules, direct the booking of accounting 
entries in complex areas including mergers and acquisitions, hedge accounting, 
deferred tax and other complex areas. In scores of smaller public companies, 
external auditors have played key roles preparing the financial statements and 
accompanying notes. Under the current SOX rules, requiring the auditor to report 
on management control system will, by definition, require the auditors to opine on 
the reliability of management using the external auditor as a control. Forbidding 
smaller public companies from using their external auditor to provide direct 
assistance in these areas will require that management brief two sets of external 
professionals (one being their external auditors and the other being accounting 
experts/consultants) on these issues and bear the related incremental costs. 

4. UNFAIR PLAYING FIELD - To date, no other country in the world has 
accepted the cost/benefit value of a subjective auditor opinion on control 
effectiveness (section 404(b) ) Three countries, the UK, Canada and Japan, have 
all directly rejected the merits of this approach after rigorous study. We believe 
that a significant number of companies considering raising funds in the capital 
markets will find alternatives to U.S. capital markets, particularly those in the UK 
and Canada, due to the significantly less complex control governance rules and 
lower compliance costs. 

5 . QUALITY BAR SET TOO HIGH - The current and proposed regulations 
require that management produce draft financial statements that are free of any 
material errors. The existence of even one material error detected by the 
company’s auditors requires, in all but a few instances, a representation by the 
company’s CEO and CFO that the company has an ineffective control system. 

Our field research indicates that in a very high percentage of smaller public 
companies, their auditors have routinely found errors material enough in size that 
adjustments must be made before the auditors provide their certification. A zero 
material error bar in draft financial statements produced by smaller public 
companies, while a laudable goal, will put U.S. listed companies at a disadvantage 
relative to small cap companies in other countries. 

6. LITIGATION IMPACT ON MANAGEMENT AND AUDITORS - The 
current and proposed SOX regulations significantly increase the legal liability of 
both auditors and senior management. Both are being asked to certify that the 
current controls will allow a material error only in very limited circumstances. 
History is already proving control effectiveness predictions being made under the 
current regulations to have a very high error rate. This has already started a new 
category of litigation focused on negligence in section 404 representations. 
Adding an additional 12,000 smaller public companies and their auditors in to this 
poo! of litigation targets will not, over the longer term, serve the best interests of 
society except in extreme cases involving fraud. 
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